Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by JMTQp8lwXL on Tuesday March 02, 2021 @11:03AM
(#26316707)
The business case for accepting the risk of downloading untrusted software has proven time and time again to be worth it. Without NPM modules, time to deliver would be much, much longer. If it was that bad of a problem, we would've collectively moved away. Many companies privately invest in their own registries that proxy to NPM, with an intermediary security layer. The maintainers of NPM have shown they'll cleanup the left-pad's and major security issues when they occur.
[ Parent
| on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by goatinaboat on Tuesday March 02, 2021 @11:10AM
(#26316786)
Without NPM modules, time to deliver would be much, much longer.
This is a circular argument. “We chose a language that has millions of tiny dependencies now we need a tool to manage millions of tiny dependencies”
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by JMTQp8lwXL on Tuesday March 02, 2021 @01:07PM
(#26318291)
If you must ship JavaScript for the web, you don't have much of a choice in languages (you might choose a superset like TypeScript, which is still distributed via the NPM ecosystem). For server-side code, agreed. You don't have to choose Node.js or JavaScript or NPM there.