3 ms·
Right! that's what I thought this is left-pad all over again. Although left-pad was really just a disgruntled publisher... this involves a malicious third part
by cphoover 8y ago
Right! that's what I thought this is left-pad all over again.
Although left-pad was really just a disgruntled publisher... this involves a malicious third party.
My suggestion in fixing the later would be to enforce 2FA for publishing of packages that have so many dependents.
Award a badge to a release when it is published with 2FA. So for LTS releases they can be verified as manually published. This will impact package consumers decision making process, on whether or not to include a dependency into their package.json.