3 ms·
These get detected almost immediately, and removed by npm within hours (axios, tanstack at least)
by eranation 5mo ago
These get detected almost immediately, and removed by npm within hours (axios, tanstack at least)
- Hackbraten 5mo agoBut who will detect them on day one once everyone ignores them for seven days?
- bakkoting 5mo agoThese things are usually caught by tools specifically scanning npm or by the maintainers noticing their account is compromised, not by people auditing their own installed packages.
- aoeusnth1 5mo agoAI agents
- eranation 5mo agoThere are some companies that specialize in detecting those, they do it for free (and get lots of marketing for it…)