News for hackers. Stuff that matters.

A comment on Postmortem for Malicious Packages Published on July 12th, 2018. Parent comment

Re:Postmortem for Malicious Packages Published on July 12th,... by Benjammer on Thursday July 12, 2018 @06:26PM (#17519133)
A malicious change could have already been published somewhere else, couldn't it have? And we just haven't found it yet?
[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by Prefinem on Thursday July 12, 2018 @06:38PM (#17519207)
Just saying they didn't do nothing. Maybe they didn't do as well as they could have, but they did do something.
[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by mirashii on Thursday July 12, 2018 @06:46PM (#17519255)
Calling it resolved is worse than doing nothing. If they had done nothing, at least people would know that "If I run npm install now, that's bad". Now they've claimed it is resolved, which tells their users "It's okay to start installing things again" when it isn't safe until an audit has been completed.
[ Parent | on HN ]