4 ms·

That means going back to disabling Javascript or only allowing widely used, well-maintained Javascript libraries.

• mschuster91 5mo ago
  > or only allowing widely used, well-maintained Javascript libraries. That isn't a guarantee either, just last month someone compromised the Axios library.
  • skydhash 5mo ago
    They stole the axios's npm keys and they uploaded malicious artifacts. They did not takeover the axios's repo. The issue is with packaging and distribution, not with code.
    • pocksuppet 5mo ago
      What's the meaningful distinction between those two things? You imported axios, you got pwned. Same result either way.
      • skydhash 5mo ago
        Because the way npm works means that as soon as a developer key got stolen, a lot of people got pwned. The key is the only barrier. Compare that with the average distro. You would have to compromise the developer infrastructure (repo or website) and publish a new version without them being aware while notifying the maintainer that’s its ok to merge the new package script in the distro repo. Hard to pull off in high profile projects.