Can NPM be an opton ?

[jehoshua7]

I'm concerned about whether NPM is safe or not. Safe as in a security aspect. So, can it be optional ?

My thoughts at https://discourse.gohugo.io/t/is-npm-safe/38385/2

[razonyang]

I'm afraid not. The npm is required by this theme for installing dependencies.

The common web application attack vectors don't apply to a strictly static website. Without interactive elements there are no accounts to hijack or cookies to steal.

• Which security measures make sense for a static web site?

[jehoshua7]

I'm afraid not. The npm is required by this theme for installing dependencies.

What level of testing `npm' is done prior to a release ?

The common web application attack vectors don't apply to a strictly static website.

If Hugo was strictly static, it would be only HTML and CSS. However `npm' leaves it open to the kind of attack mentioned at https://research.swtch.com/npm-colors

[razonyang]

The npm is just a registry of packages. The whole thing is built on the trust in the dev community and sharing. Even if we use Hugo modules as dependency management(such as Bootstrap, FontAwesome), we will face the same problem.

BTW, this theme has been using NPM, in the previous versions before releasing v0.68.0, the prebuilt CSS and JS dependencies were also installed by npm. The difference is that the assets are prebuilt on my laptop by myself. And later version's assets were built by the users.

[jehoshua7]

BTW, this theme has been using NPM, in the previous versions before releasing v0.68.0, the prebuilt CSS and JS dependencies were also installed by npm. The difference is that the assets are prebuilt on my laptop by myself. And later version's assets were built by the users.

Okay thanks. So how far 'back' would I have to go to completely exclude an npm dependancy ?

BTW, the comments by bep at https://discourse.gohugo.io/t/is-npm-safe/38385/5 are very relevant and helpful. I think he is the primary developer of Hugo, so his comments about `npm' are very important.

Any theme of this nature relies on the engine/Hugo for building.

[razonyang]

Unfortunately, all versions of this theme are built on top of npm modules/packages, you could use the v0.67.1 if you don't want to build the assets yourself. However, you will not receive subsequent features and bug fixes with that version.

[jehoshua7]

@razonyang Okay thanks for your help.

[jehoshua7]

Discussions continuing at https://discourse.gohugo.io/t/is-npm-safe/38385/