3 ms·
A malicious change could have already been published somewhere else, couldn't it have? And we just haven't found it yet?
by Benjammer 8y ago
A malicious change could have already been published somewhere else, couldn't it have? And we just haven't found it yet?
- Prefinem 8y agoJust saying they didn't do nothing. Maybe they didn't do as well as they could have, but they did do something.
- mirashii 8y agoCalling it resolved is worse than doing nothing. If they had done nothing, at least people would know that "If I run npm install now, that's bad". Now they've claimed it is resolved, which tells their users "It's okay to start installing things again" when it isn't safe until an audit has been completed.