he/him 
Wow, @timer150 built a bot that creates a canary package for each PR to Create React App! Check it out: https://github.com/facebookincubator/create-react-app/pull/3124#issuecomment-329472767 …pic.twitter.com/x6d28Jv1KR
-
Can you clarify the attack vector? My understanding is bot doesn’t actually *run* the thing being published, it just publishes it.
It doesn’t have access to the real thing though, just the bot.It presumably has to bootstrap and run all of create-react-apps publish scripts and installation. So you just add some code there?
-
-
That’s fair. I’m not sure if it does (we currently don’t use bundling) but we do have a build step for one package.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Unless this is being done in a sandboxed environment like Travis / AWS Lambda
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.