NPM package event-source-polyfill compromised by political activists

Re:NPM package event-source-polyfill compromised by politica... by sergiotapia on Friday April 08, 2022 @09:02PM (#30964313)

Why does the JS ecosystem attract so many puddingheads like this with their emojis and their cotton-candy bullshit? No wonder it's a house of cards.

[ Parent | on HN ]

Re:NPM package event-source-polyfill compromised by politica... by adamscybot on Friday April 08, 2022 @09:05PM (#30964334)

TBH I think its not because JS somehow fundamentally attracts a different group of people, its probably more like:

- It being web based means you can target this kind of software for maximum "impact"

- NPM dep trees are massive and you generally have thousands of tiny libs. The chance of something like this happening and being noticed goes up therefore.

- NPM ecosystem is a bit more wild west which again leads to increased chance of something like this being able to occur in the first place.

[ Parent | on HN ]

Re:NPM package event-source-polyfill compromised by politica... by ev1 on Saturday April 09, 2022 @01:03AM (#30965387)

On the emoji side: JS devs are frequently fullstack/designers sometimes/on Macs, which make emoji very easy to use.

So they end up using it.

You rarely/ever see things like emoji commit messages in the other worlds (ex C#, Java, etc)

[ Parent | on HN ]