Re:Recap of the `funding` experiment
by feross on Thursday August 29, 2019 @02:59AM
(#20827336)
If the only thing this whole saga accomplishes is that npm post-install scripts are replaced with proper pre-built binary support, then I'll say this was all worth it. :)
[ Parent
| on HN ]
Re:Recap of the `funding` experiment
by freeone3000 on Thursday August 29, 2019 @10:57AM
(#20830054)
The post-install scripts are installed from the same source as the actual library - the library itself could contain whatever malicious code an attacker wants. Pre-built binaries don't help here.