SecurityAdvisories

I arrived at a similar model for NPM using hooks in pnpm: https://github.com/captn3m0/npm-sec-feed. I love the work Packagist/Composer is doing in the space. I’m now a firm believer that every package manager needs to support hooks globally. Composer also supports conflicts which results in this amazing approach of having a meta-package conflict with insecure packages: https://github.com/Roave/SecurityAdvisories. Can’t happen in Node, sadly because of language differences.

Apologies for not replying yesterday. The security threat monitoring is actually still in development. Principally it will be based on checking if your dependencies include versions with disclosed vulnerabilities. The plan is to do this with a combination of SensioLabs Security Checker[1] and Roave Security Advisories[2]. I'm working on other approaches too and eventually I hope to have a way to allow package developers to report vulns directly. [1]: https://github.com/sensiolabs/security-checker [2]: https://github.com/Roave/SecurityAdvisories

I haven't researched the JS options in this space yet either, but if anyone reading is looking for something like this for PHP, there is Roave Security Advisories — https://github.com/Roave/SecurityAdvisories Add it to your composer.json and it will simply conflict with all lib versions with known vulnerabilities. The data source used (https://github.com/FriendsOfPHP/security-advisories) has an excellent history of keeping up-to-date. Disclosure: I'm the founder of Roave.