3 ms·
I guess it's not npm specific, because the same thing can happen in any other open source repo, can't it? Some guy takes over maintenance of a dormant package a
by dmortin 8y ago
I guess it's not npm specific, because the same thing can happen in any other open source repo, can't it? Some guy takes over maintenance of a dormant package and then adds code which no one bothers to check.
- ghostly_s 8y agoWell, not really. Anyone can "take it over" in the sense of creating a new, maintained fork, but the various distro package managers have policies that I think generally require some review/approval process to transfer ownership of a package they publish. I don't know anything about NPM, but imagine it's a more lax process than something like Debian. It sounds like the maintainer here did something shady or simply reckless in effectively transferring ownership but not disclosing this to folks at NPM?
- raesene9 8y agothere's a split here. Linux package managers (by and large) have a maintenance process. Programming language package managers, by and large, do not So this could happen on rubygems, PyPi, Nuget, etc
- dcbadacd 8y agoThankfully other languages really do require less less known external packages.