ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by pitaj on Thursday July 12, 2018 @11:52AM (#17515770)

URL imports is a terrible idea. There's a reason we have actually package managers and repositories instead of installing from GitHub.

Properly made and run package managers are more secure and offer a better developer experience than importing by URL.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by ricardobeat on Thursday July 12, 2018 @02:23PM (#17517257)

Which package managers are properly made, and how are they more secure? As far as I'm aware npm's security model is shared with almost all of them.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by erik_seaberg on Thursday July 12, 2018 @02:53PM (#17517525)

RPM and .deb packages have GPG signatures and lists of trusted maintainers. NPM doesn't have that; https://medium.com/redpoint/introducing-pkgsign-package-sign... looks like a very early start on a big project that could fix this if it catches on.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by eptcyka on Thursday July 12, 2018 @03:24PM (#17517792)

Cargo is far better in this regard, for one.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by Arnavion on Thursday July 12, 2018 @05:35PM (#17518817)

Cargo packages can also execute arbitrary code at compile-time through build scripts, which run with full permissions of the original `cargo` command including filesystem and network access.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by msoad on Thursday July 12, 2018 @02:48PM (#17517493)

> package managers are more secure

How?

[ Parent | on HN ]