3 ms·
The packages served to the vendor could be legit, but packages served to everyone else is compromised. The vendor would never know there was a problem.
by steve19 8y ago
The packages served to the vendor could be legit, but packages served to everyone else is compromised. The vendor would never know there was a problem.
- windows_tips 8y agoOne could use hash signatures to detect a problem.
- _Adam 8y agoThe hash comes from the source of the package, and in this attack that source was compromised. The malicious code was signed.