Embedded malware in RC (NPM package)

Re:Embedded malware in RC (NPM package) by peteatphylum on Friday November 05, 2021 @08:36PM (#29126284)

I wish it worked that way. I just peeked into how python packages in debian-based distros work. They are most frequently PyPI packages with some debian wrapping, so we're back at the same problem.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by matheusmoreira on Friday November 05, 2021 @09:14PM (#29126565)

PyPI allowed me to make an account and just push packages there like it was nothing. Great for me, not so great for users.

These Debian wrappers, however minimal, imply the existence of a maintainer trusted by the Debian community. It's assumed that this maintainer has read the source code and determined it is safe.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by djbusby on Friday November 05, 2021 @11:13PM (#29127180)

Or at least pinned a version that is known good

[ Parent | on HN ]