News for hackers. Stuff that matters.

A comment on Dozens of malicious PyPI packages discovered targeting developers. Parent comment

Re:Dozens of malicious PyPI packages discovered targeting de... by koolba on Wednesday November 02, 2022 @02:11PM (#33440417)
> Only one typo in an import statement up the dependency chain and you’d be compromised.

Doesn’t even have to be a typo if the actual project is compromised. Like one of the 100s of NPM modules without 2FA for publishing.

[ Parent | on HN ]

There are no comments on this comment yet.