3 ms·

Spam is not a problem GitHub has ever had to seriously face so far but this sort of attack does seem like it could catch some users casually googling for librar

Spam is not a problem GitHub has ever had to seriously face so far but this sort of attack does seem like it could catch some users casually googling for libraries. If you impersonated all these real repos, made npm, pypi packages for them etc and also updated the readme I think you could catch some people off guard.

nicce 4y ago
This is a real problem indeed. There have been reports about successful ones. https://www.theregister.com/2022/07/06/npm_supply_chain_attack/ https://www.theregister.com/2022/07/06/npm_supply_chain_atta... https://www.idstrong.com/sentinel/npm-packages-info-stolen/ https://www.idstrong.com/sentinel/npm-packages-info-stolen/