4 ms·
> A related issue is that NPM distributed malicious code to people. That sounds like a problem between people that downloaded the malicious version and NPM. Not
by heartbreak 8y ago
> A related issue is that NPM distributed malicious code to people. That sounds like a problem between people that downloaded the malicious version and NPM. Not sure how the author is involved.
It's an author/maintainer issue (and not an NPM issue) because the maintainer explicitly gave the bad actor the right to publish via NPM's delivery channel. The maintainer did so in gross negligence, in my opinion.
- jrockway 8y agoIf courts agree with you, the world of free software is over. It will be too risky to accept contributions. Github and NPM will be shut down over lawsuits. For that reason, I think you are wrong.
- heartbreak 8y agoIt is risky. Ask one of the 17 law firms involved with Oracle v Google if open source licensing is too risky.