News for hackers. Stuff that matters.

A comment on Alert: NPM modules hijacked. Parent comment

Re:Alert: NPM modules hijacked by raesene4 on Wednesday March 23, 2016 @12:23PM (#11345845)
for NPM? As far as I'm aware it's not even an available feature. None of rubygems/PyPi/NuGet require digital signatures...

What repositories were you thinking of that do require that?

[ Parent | on HN ]
Re:Alert: NPM modules hijacked by pvg on Wednesday March 23, 2016 @12:48PM (#11346074)
NPM doesn't. Maven does. Debian has authentication of the repository itself.
[ Parent | on HN ]
Re:Alert: NPM modules hijacked by raesene9 on Wednesday March 23, 2016 @12:56PM (#11346184)
yep the linux repositories are generally way ahead of the programming language lib ones in this regard (evidently with the exception of Maven), one of the reasons that it's a shame to see newer ones not learn the lessons that previous repo's have on security
[ Parent | on HN ]