34 ms·
This class of exploit is interesting, but it's totally overshadowed by the fact that every Google engineer is probably downloading dozens of public packages per
by phendrenad2 4y ago
This class of exploit is interesting, but it's totally overshadowed by the fact that every Google engineer is probably downloading dozens of public packages per day, any of which could be compromised at any time. Plus those attacks are even better because you don't need guess what the original package did to avoid detection.
- knallfrosch 4y agoThis. Any package can be anything at any time. Remember when left-pad (10 lines of code) was deleted by its author in 2016? Build systems all over the world failed so hard, NPM had to reinstate the package against its own rules. left-pad's author could have done anything with all the dependencies on his package.