Another insidious exploit is to hijack the maintainer's package manager account and push the code directly there, bypassing the repository altogether. It doesn'

Another insidious exploit is to hijack the maintainer's package manager account and push the code directly there, bypassing the repository altogether. It doesn't rely on you installing a new package since the hijacked package in question is already a dependency of yours. I got into a habit of checking both the package manager and the project's repository before updating any given dependency. https://news.ycombinator.com/item?id=20377136 https://news.ycombinator.com/item?id=20377136