Malicious PyPI packages stealing credit cards and injecting code

Re:Malicious PyPI packages stealing credit cards and injecti... by oblio on Tuesday August 03, 2021 @10:00AM (#28049269)

Java/Spring/Maven should have locked down dependencies by default. They have to go out of their way to not do that. Not that some people don't, anyway.

Typos:

> I stopped advocating for locking everything down.

started?

> Look down dependencies.

lock?

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by nvrspyx on Tuesday August 03, 2021 @10:09AM (#28049368)

I think the first typo is actually correct. They're saying that they stopped advocating for it because everyone treated them like they were crazy for doing so.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by watermelon0 on Tuesday August 03, 2021 @01:16PM (#28051715)

AFAIK Maven and Gradle don't have any built-in way of locking down dependencies (direct or transient), unless I missed something.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by cesarb on Tuesday August 03, 2021 @03:50PM (#28053314)

In my experience, Maven always uses the exact version specified in your pom.xml (and the pom.xml of your dependencies, transitively), it never uses a newer version automatically. That is, the built-in way in Maven is locked down dependencies.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by specialist on Tuesday August 03, 2021 @10:47AM (#28049837)

Edited. Thanks for proofreading my rant. :)

[ Parent | on HN ]