4 ms·
In this case, the developer sold the user account & repository for money (no ownership change to monitor).. so if you were not privy to that transaction, you re
by ldoughty 2y ago
In this case, the developer sold the user account & repository for money (no ownership change to monitor).. so if you were not privy to that transaction, you really couldn't "easily" avoid this without e.g. forking every repo you depend on and bringing it in house or some other likely painful defense mechanism to implement
- skydhash 2y agoThat’s why businesses pay Redhat, Qt, Unity,… Clear contracts that reduces the risk of compromised dependencies. Or you vet your dependencies (it helps when you don’t have a lot)