News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by cecilpl2 on Monday January 10, 2022 @04:00PM (#29882356)
Of course he did. Intent matters, and this was a reasonably foreseen consequence of the way the system is set up.

He knew how npm works and he knew the implication of adding that code is that hundreds of libraries and production systems would automatically upgrade and install it.

In fact, the whole point of what he did was to introduce the code into production environments.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by jessaustin on Monday January 10, 2022 @10:18PM (#29887006)
Raise your hand if you pull directly from the internet into production without testing!

<no hands raised>

How can we claim he did anything to production if no one will admit they're dumb enough to push this latest version without testing it?

[ Parent | on HN ]