News for hackers. Stuff that matters.

A comment on Pear.php.net shuts down after maintainers discover serious supply-chain attack.

Re:Pear.php.net shuts down after maintainers discover seriou... by ddtaylor on Thursday January 24, 2019 @06:56AM (#18987893)
Does anyone know if composer ever uses PEAR?
[ Parent | on HN ]
Re:Pear.php.net shuts down after maintainers discover seriou... by rawfan on Thursday January 24, 2019 @07:22AM (#18988010)
It doesn't.
[ Parent | on HN ]
Re:Pear.php.net shuts down after maintainers discover seriou... by Gigablah on Thursday January 24, 2019 @07:47AM (#18988154)
Composer does support pulling packages from PEAR (https://getcomposer.org/doc/05-repositories.md#pear), but through their own implementation and not go-pear.phar.
[ Parent | on HN ]
Re:Pear.php.net shuts down after maintainers discover seriou... by SmellyGeekBoy on Thursday January 24, 2019 @11:18AM (#18990004)
...but that doesn't mean that it wouldn't also be susceptible to this kind of attack.
[ Parent | on HN ]