Malicious code in the purescript NPM installer

Re:Malicious code in the purescript NPM installer by justinclift on Monday July 29, 2019 @01:03AM (#20551646)

You may be correct for javascript, whose ecosystem is notoriously unstable and the equivalent of "building on sand".

eg write some code in a JS framework, then go off and do something for 18 months. Come back and there's a very good chance the entire framework has been obsoleted and replaced, perhaps even several times.

In JS land that's "Doh, well of course!".

In sane ecosystems (eg not Ruby), not so much. ;)

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by halostatue on Monday July 29, 2019 @01:03PM (#20556780)

This is a problem for _any_ active development package, to the point where most language communities have (previously had) instructions on how to fix breakage of the language introduced by, for example, arbitrary Debian packaging restrictions without working with the language maintainers.

I seen this in _any_ environment that has a relatively active package management system of its own (e.g., Ruby, Perl, and Python included)—and it _still_ happens in some Java cases. The only _sane_ thing to do is to completely ignore the OS package management system and to package your applications as relocatable install packages complete with all dependencies you need, modulo the minimal OS stuff required.

[ Parent | on HN ]