4 ms·
Of course. A malware-infected dependency has motivation to pay for GitHub stars and fake repo activity. I would never trust any metric that measures public "use
by ryandrake 1y ago
Of course. A malware-infected dependency has motivation to pay for GitHub stars and fake repo activity. I would never trust any metric that measures public "user activity". It can all be bought by bad actors.
- jstanley 1y agoThen what do you do instead?
- ryandrake 1y agoWould totally depend on the project and what kinds of risks were appropriate to take given the nature of the project. But as a general principal, for all kinds of development: "Bringing in a new dependency should be A Big Deal." Whether you are writing a toy project or space flight avionics, you should not bring in unknown code casually. The level of vetting required will depend on the project, but you have to vet it.
- 1718627440 1y agoSkim through the code? Sure it's likely to miss something, but it still catches low-effort and if enough people do it someone will see it.