4 ms·

And this, kids, is why you should vendor your dependencies

• jkrems 11mo ago
  Vendoring wouldn't really affect this at all. If anything it would keep you vulnerable for longer because your vendored copy keeps "working" after the bad package got removed upstream. There's a tiny chance that somebody would've caught the 10MB file added in review but that's already too late - the exploit happened on download, before the vendored copy got sent for review.
  • withinboredom 11mo ago
    But you would have code reviewed it