Re:Plot to steal cryptocurrency foiled by NPM
by matthewbauer on Saturday June 08, 2019 @07:17PM
(#20135844)
This same thing is done anywhere semver is used or any other version range system. This includes python, rust, go, and many more.
[ Parent
| on HN ]
Re:Plot to steal cryptocurrency foiled by NPM
by fwip on Saturday June 08, 2019 @07:27PM
(#20135897)
Go's official package management solution actually only fetches the minimum specified version of each dependency. So auto-upgrades never happen except when you explicitly update a dependency to a newer version.