2 ms·

But then the attacker would need to register a ton of packages that match other popular packages under their namespace which can set off some alarms. (I guess "

But then the attacker would need to register a ton of packages that match other popular packages under their namespace which can set off some alarms. (I guess "solve" was a bit too strong of a word to use there...) There could also be some other cool tricks you could apply (This is the first time you are installing a package from "Maintaner", would you like to continue?)

jessaustin 10y ago
An attacker would only need to register the equivalent of the package under attack. Other packages would continue to error out harmlessly as they did before. The maintainer-level confirmation could be of slight assistance to advanced users, but it's no panacea.