3 ms·
I don't see how the same thing couldn't happen with an elm package? The attacker can commit to the github repo.
by gyrgtyn 8y ago
I don't see how the same thing couldn't happen with an elm package? The attacker can commit to the github repo.
- always_good 8y agoBe specific: what exactly would you do in Elm to pwn someone? It would be a much more limited and a much more visible attack. NPM modules don't even have source code on display. Someone has to download and check the tarball before npm install. Also, Elm packages are qualified by a github username so there isn't an ecosystem of ownership transfer. No juicy name squatting. People just fork. Finally, don't forget that my point is "there are a few issues with NPM that make this kind of thing especially easy/lucrative". That's a far cry from "everything else is bullet-proof" but it's tempting to argue with me as if I'm saying that.