4 ms·

exactly, transferring a package to an unknown person is not only giving them access to the code but also to all the people who already trust that code

• AnaniasAnanas 8y ago
  To be honest that kind of your fault for trusting that code. Heck, the commits were not even signed as far as I know, had they been signed the change of "ownership" would have been clear.
  • meowface 8y ago
    Makes no difference if they were signed or not. He handed over the NPM package, not the GitHub repo. NPM doesn't show commit history or authors and has no connection to GitHub; you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely different, malicious code in the package.
    • AnaniasAnanas 8y ago
      > not the GitHub repo He did that too actually. > you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely different, malicious code in the package This is one of the biggest issues that NPM has, along with not enforcing packages to be signed. If the package was signed this would not be an issue as people would see that the signer changed.