5 ms·
I’m honestly surprised this sort of thing doesn’t happen more often. One of the fastest ways to monetize an open source software package is to sell your GitHub
by lockhouse 4y ago
I’m honestly surprised this sort of thing doesn’t happen more often.
One of the fastest ways to monetize an open source software package is to sell your GitHub login to a bad actor or put malware in it yourself.
It would be extremely easy for a state level actor to compromise an npm dependency through bribery or blackmail.
- FezVrasta 4y agoPopper.js maintainer here, we haven't been compromised. They just injected the malware in that position but the malware didn't come from our npm release