2 ms·

Nope. You can't solve phishing with technological means. You have to curate either a whitelist or blacklist. The best way to handle this is whitelists of trust

Nope. You can't solve phishing with technological means. You have to curate either a whitelist or blacklist. The best way to handle this is whitelists of trusted package maintainers and/or code authors.

kumarvvr 9y ago
Ohh ok. Thanks. Great to know.
zapt02 9y ago
To be fair you can do a lot with simple heurestics. New package + large number of downloads || new package || new package author = show users a warning message before installing the package.