3 ms·

Github is NPM's parent company at this point, so I guess they have similar policies for dealing with this sort of stuff at this point. My best guess is MSFT (w

• giaour 4y ago
  I didn't realize that GH owned NPM. Still, I would expect policies on bans to be pretty different between the two given the different roles each org plays in the larger ecosystem. Microsoft has taken some fairly assertive political stances wrt Ukraine, so I'm not sure corporate neutrality is to blame here (take this with a grain of salt: I work for MSFT, albeit not on anything remotely related to policy or comms).
• unknownaccount 4y ago
  They already took a political stance by letting him be unbanned. Theres no way this would ordinarily be allowed. But since the victims were only Russian and Belarusian people, Microsoft let the perpetrator get away with the crime. The message Microsoft is sending right now is loud and clear: That they dont take malware threats seriously. That it isnt a big deal when users upload malicious code / trigger a supply chain attack that permanently deletes peoples files. Because the worst thing that can happen is only a minor slap on the wrist.