3 ms·
It could indeed be a security issue. A few options: - Make a PR to a project that changes e.g. one of the dependencies to typosquatted alternatives. Disguise t
by ryukafalz 6y ago
It could indeed be a security issue. A few options:
- Make a PR to a project that changes e.g. one of the dependencies to typosquatted alternatives. Disguise the commit message as something trivial. Post it to HN with a GH link to the upstream project's repo at your commit.
- Make a PR to a project that adds malicious code, suggest a change to a distro package's source repo to use your commit. Unless the maintainers know about this GitHub behavior, that'll look much more trivial than it actually is.