Malicious crossenv package on npm

Re:Malicious crossenv package on npm by danjoc on Tuesday August 01, 2017 @06:47PM (#14906201)

>Maven has this problem

What malicious packages have been found on Maven central?

[ Parent | on HN ]

Re:Malicious crossenv package on npm by KirinDave on Tuesday August 01, 2017 @06:50PM (#14906225)

Why don't you google or follow the link I already gave?

[ Parent | on HN ]

Re:Malicious crossenv package on npm by danjoc on Tuesday August 01, 2017 @06:53PM (#14906243)

Exactly what I thought. You can't name one. Coincidentally, Maven central requires GPG signatures.

[ Parent | on HN ]

Re:Malicious crossenv package on npm by KirinDave on Tuesday August 01, 2017 @07:00PM (#14906282)

As we all know you can only sign a piece of code if it is free of malicious software.

Heck, I read that you can't even make a GPG key without proving your virtue to Richard Stallman in festivus-style competition.

[ Parent | on HN ]