Re:Malicious code in the purescript NPM installer
by oefrha on Monday July 29, 2019 @10:44AM
(#20555100)
My software is packaged by Debian, and the update process is me notifying the Debian Developer (DD) responsible for the package of the new version => said DD pulling the new tarball from GitHub. Pretty sure no one’s gonna notice until after it’s pushed to Debian FTP if I introduce some subtle malicious code. Point is DDs don’t review version deltas for the most part, so when the upstream is compromised, they add little to your defense (other than security by outdatedness, I suppose).
[ Parent
| on HN ]
Re:Malicious code in the purescript NPM installer
by umanwizard on Tuesday July 30, 2019 @09:46PM
(#20571031)
Sure, but a very long time will pass between it being uploaded and being merged into stable, so there is a lot of time for people to discover your malicious code.
It is not like npm or crates.io where you can just upload whatever random code you like and people will start picking it up immediately.
But it’s not foolproof, sure, I agree with that.