ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by mijamo on Thursday July 12, 2018 @12:35PM (#17516257)

But how would you know that the sourced on NPM same as the ones you have? Except if you require all NPM packages to be hosted on Github but that does not seem like a good idea to me.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by consumer451 on Thursday July 12, 2018 @01:19PM (#17516698)

Couldn't some simple standard be developed to allow non-github repo hosts to also be used?

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by proneb1rd on Thursday July 12, 2018 @06:57PM (#17519313)

Like gpg the payload and make sure npm has a public key.

[ Parent | on HN ]