News for hackers. Stuff that matters.

A comment on Dozens of malicious PyPI packages discovered targeting developers. Parent comment

Re:Dozens of malicious PyPI packages discovered targeting de... by augusto-moura on Wednesday November 02, 2022 @05:25PM (#33443126)
The problem is the tree of dependencies you might check. Sure you can check the changes in a direct dependency, but when that dependency updates a few others and those update a few others, the number of lines you need to read grow very quickly
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by heleninboodler on Wednesday November 02, 2022 @05:27PM (#33443147)
Golang flattens the entire dependency tree into your vendor directory. It's still not that big. The current project I am working on has 3 direct external dependencies, which expands out into 22 total dependencies, 9 of which are golang.org/x packages (high level of scrutiny/trust). It's really quite manageable.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by tornato7 on Thursday November 03, 2022 @02:45PM (#33455521)
Indeed, gophers often make it a point of pride to have no dependencies in their packages.
[ Parent | on HN ]