News for hackers. Stuff that matters.

A comment on Worrying about the NPM Ecosystem. Parent comment

Re:Worrying about the NPM Ecosystem by chocolatkey on Monday June 29, 2020 @10:16PM (#23685814)
If packages are "trusted", how would NPM ensure that they are continually trusted as new versions come out? I've read those stories with packages whose developers hand them over for maintenance, and then a new update comes out with malicious code
[ Parent | on HN ]
Re:Worrying about the NPM Ecosystem by erichurkman on Monday June 29, 2020 @10:31PM (#23685898)
M of N signatures on new version tags, or on ranges of commits?
[ Parent | on HN ]