6 ms·
A lot of libraries are maintained by a single person.
by habinero 7mo ago
A lot of libraries are maintained by a single person.
- themafia 7mo agoAre those the ones typically involved in supply chain attacks? There are no perfect solutions; but, let's be reasonable.
- ArcHound 7mo agoActually, yes, they are the prime targets: https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident or seemingly https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor as well.
- themafia 7mo agoxz has dozens of contributors and two active maintainers. It was the actual example I was thinking of. The code was submitted by a third party and not a result of a developer machine compromise. left pad wasn't a security incident. It was a capitalism incident.