What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by prmoustache on Tuesday January 11, 2022 @07:55AM (#29890934)

Aren't developers always using the same version and blindly downloading and running malicious code doing the same thing, running a single version?

Only those were harmed. And by harmed it was just really a bunch of tests runs failing, I guess no production workload was impacted by that jerk move.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by sam0x17 on Friday January 14, 2022 @12:13PM (#29937110)

Right, but my point is this code, in and of itself, really isn't malicious. It's only malicious in the context of "version XYZ used to do X, now it does Y". If you make versions indelible, you eliminate the potential for this to blow up as an issue.

[ Parent | on HN ]