News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by judge2020 on Monday January 10, 2022 @07:46PM (#29885485)
They supposedly took over the npm packages[0,1], not the github.com repos. npm is a system where you push archives as package versions, it doesn't do its own pull from a github repo or otherwise.

To add, unused/squatted npm package names regularly get reassigned[2].

0: https://www.npmjs.com/package/colors

1: https://www.npmjs.com/package/faker

2: https://docs.npmjs.com/policies/disputes#definitions

[ Parent | on HN ]

There are no comments on this comment yet.