If dependencies are imports from URLs, how does one audit their dependencies?
If a server gets hacked those TS can be replaced with malicious versions.
In npm we at least know that a package is immutable once published, someone could publish a malicious version as a newer release but a current release.
Does demo generate some type of file that keeps a hash of all downloaded imports to verify against the next time those imports are downloaded?
If a server gets hacked those TS can be replaced with malicious versions.
In npm we at least know that a package is immutable once published, someone could publish a malicious version as a newer release but a current release.
Does demo generate some type of file that keeps a hash of all downloaded imports to verify against the next time those imports are downloaded?