3 ms·
Sabotage: Code added to popular NPM package wiped files in Russia and Belarus
- mdmglr 5y agoI think this is a great reminder that if you work with JS to pin your dependencies with a lock file and to have some process to verify packages before blindly updating them.
- ajdude 5y agoEvery time I see something come up about an npm package getting compromised, I think of this: “ I will pay you cash to delete your npm module” https://drewdevault.com/2021/11/16/Cash-for-leftpad.html https://drewdevault.com/2021/11/16/Cash-for-leftpad.html