News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by heavyset_go on Monday January 10, 2022 @09:17PM (#29886421)
> to sabotage downstream code in revenge for not being paid for work he willingly took on knowing full well that he may never be paid?

Some consumers of his project chose to use his 3rd party dependency in their code for free knowing full well that it could disappear or break at any time, and yet they still chose not to mitigate those risks they chose to take on.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by naikrovek on Monday January 10, 2022 @10:42PM (#29887211)
yes, that is the other half of the coin: don't run code if you don't know what it does.

an extreme version of that: don't use libraries at all.

I am trending more and more to this extreme as I age, because people aren't learning their lesson, and the npm ecosystem keeps biting them over and over...

[ Parent | on HN ]