Re:Malicious code in the purescript NPM installer
by mschuster91 on Monday July 29, 2019 @02:45AM
(#20552038)
Why not resolve the owner name to some kind of uuid at time of package require/install and saving it in the lockfile? That way, a package upgrade can detect if the owner name has changed and fetch the correct package.
[ Parent
| on HN ]
Re:Malicious code in the purescript NPM installer
by gridlockd on Monday July 29, 2019 @09:31AM
(#20554382)
This doesn't solve the issue where you type "npm i -s letf-pad" and your computer gets taken over by The Russians™.
Make people copy-paste the name, it decreases the chances of catastrophic failure.