3 ms·

Constant stream of malware is posted to NPM, PyPI, and all package managers

• rlpb 3y ago
  Not all package managers. The distribution packaging model doesn't have this problem.
  • richbell 3y ago
    I'd love a comparison of malware uploaded to npm versus, say, Maven Central.
• greatgib 3y ago
  Everything old is new again... Remember, before we had distribution packaging. Official distribution would carefully prepare and vet components. There was the concept to not be upstream, but to stay on "stables" revisions, with major upgrades using version of packages that would be under testing for some time before going they will be accepted into stable. Company that were doing serious software, were keeping a local repository of sources of all the packages that they had to use. Careful consideration and due diligence was done before adding a new dependency. But that was before, then low skilled and experienced young developers started to use npm, Dockers, ... And decided that old farts were too stupid to see that we can be constantly updated and it is ok to download random things from the internet at build time in your company pipeline. Also that it was so much cooler (and safe that they say) to always use the very last version available. Especially if this version is just online since a few hours...