I'm not familiar with the Node ecosystem but people blaming the maintainer for giving control of one of his unmaintained repos to a third party is frankly ludic

I'm not familiar with the Node ecosystem but people blaming the maintainer for giving control of one of his unmaintained repos to a third party is frankly ludicrous to me. I mean, why did you even trust the original maintainer in the first place? How do you know that if somebody had decided to pay him a million dollar to backdoor his package, he wouldn't have done it? Did you pay a private eye to conduct a private investigation on them? If the other dev who injected the backdoor had waited a year or so, pretending to actually maintain the package first, what then? If you're writing code dealing with sensitive information (say, credit card, cryptocurrency credentials, private information etc...) and you don't even bother to vet your dependencies and when it blows in your face your first reflex is to shift blame on some guy who's giving your source code free on the internet you should really think hard about what you're doing. Can you imagine that flying in any other industry? "Bridge collapses because company bought crappy steel from some guy off e-bay, but hey he had a trustworthy nickname." I mean, the injection was finally discovered because of a deprecation warning: https://github.com/remy/nodemon/issues/1442 https://github.com/remy/nodemon/issues/1442 I wonder how many backdoored node packages there are out there, but judging by how this issue was handled I'd guess probably more than 0. If there's one positive consequence to this cryptocurrency craze it's that it shines light on our terrible so-called "engineering" practices in the software industry.