Yeah, a tweet said this is the beginning of a decade of those sorts of attacks which I agree with. It’ll start with pip, npm, etc, then move to bigger targets.

Yeah, a tweet said this is the beginning of a decade of those sorts of attacks which I agree with. It’ll start with pip, npm, etc, then move to bigger targets. For that reason I’ve moved away from those managers and stuff like react (I trust facebook but dependency trees are huge) - the worst part is you can’t not patch, but you might be doomed by any upgrade. I think eventually it’ll snuff out innovation in medium sized businesses and government - large businesses can afford the cost of manual review and startups will ignore the risk, but middle-tier will be screwed. I’d love to see a crowdsourced review model, but I just don’t think it can be viable without getting abused.