5 ms·
> But any dynamically fetched code/modules/packages will suffer the same risk. A package manager usually employs signatures. In that case, the problem could ha
by dbrgn 5y ago
> But any dynamically fetched code/modules/packages will suffer the same risk.
A package manager usually employs signatures. In that case, the problem could have been avoided (unless the signing process itself is also compromised, then you're out of luck).
- marcinzm 5y agoThe issue only happens if the package manager platform is hacked rather than an individual package maintainer's credentials. The latter usually requires a new version to be pushed which people will notice and ask about (it's happened before). If the package manager platform is hacked then you're in trouble unless you employ a lock file.