Re:What NPM should do to stop a new colors attack
by oauea on Tuesday January 11, 2022 @08:57AM
(#29891485)
> People didn't actively go seek out a new version.
They did. They chose not to pin their dependency versions, so this is their clear explicit choice. They also chose not to test their dependency updates before pushing it through to their end users, pure negligence by e.g. AWS who was affected by this.
They did. They chose not to pin their dependency versions, so this is their clear explicit choice. They also chose not to test their dependency updates before pushing it through to their end users, pure negligence by e.g. AWS who was affected by this.