News for hackers. Stuff that matters.

A comment on 3500 packages uploaded to PyPI, pointing to a malicious URL. Parent comment

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by goatinaboat on Tuesday March 02, 2021 @11:10AM (#26316786)
Without NPM modules, time to deliver would be much, much longer.

This is a circular argument. “We chose a language that has millions of tiny dependencies now we need a tool to manage millions of tiny dependencies”

[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by JMTQp8lwXL on Tuesday March 02, 2021 @01:07PM (#26318291)
If you must ship JavaScript for the web, you don't have much of a choice in languages (you might choose a superset like TypeScript, which is still distributed via the NPM ecosystem). For server-side code, agreed. You don't have to choose Node.js or JavaScript or NPM there.
[ Parent | on HN ]