5 ms·

It isn't necessary the package was used in CI jobs only and not production servers.

• deadbunny 5y ago
  Then that's on them for not pinning dependencies. You know, ops 101. Play silly games, win silly prizes.
  • shukantpal 5y ago
    Thanks for stating the obvious. It isn't silly at all to publish malware and vaporize your reputation, right?; maybe it was good after all, people will become careful.
    • CRConrad 5y ago
      Maybe he wanted libraries that printed blather in an infinite loop. Then it can't be "malware" to put that in his own repositories. If other people don't want that, then they shouldn't pull from his repositories. If they do that anyway, then that's their own fault. Nobody forced them to.
      • shukantpal 5y ago
        That's a foolish hypothetical to construct; however, I don't have to refute it. That's because the author themselves said in this case, that the reason to submit the malware was to give a "fuck you" to the big corps.
        • CRConrad 5y ago
          > the author themselves said in this case, that the reason to submit the malware was to give a "fuck you" to the big corps. Yeah, so obviously he did want libraries that give a "fuck you" to the big corps (by printing blather in an infinite loop). Then it still can't be "malware" to put that in his own repositories. And my point still stands: If other people -- you, big corps, whoever -- don't want that, then they shouldn't pull from his repositories. If they do that anyway, then that's still just as much their own fault. Because, still, nobody forced them to.