Re:Over 100k Infected Repos Found on GitHub
by hollerith on Thursday February 29, 2024 @07:10AM
(#39548348)
Although finding over 100k infected repos is not good, it does not mean github is failing because the kind of programmer who would include an infected repo can find many other ways to create an insecure product if there weren't infected repos on github.
[ Parent
| on HN ]
Re:Over 100k Infected Repos Found on GitHub
by mgii on Thursday February 29, 2024 @09:33AM
(#39549775)
To be fair, the kind of programmer who would include an infected repo is almost everyone. Many infected repos have no indicators except for username to help you notice without a careful examination, especially in niche repos. When you have to move fast, it's natural to make such mistakes.
Re:Over 100k Infected Repos Found on GitHub
by cogman10 on Thursday February 29, 2024 @10:06AM
(#39550286)
Further, transitive dependencies are a real risk. If A depends on B depends on C depends on D depends on E depends on F, and F is compromised which the author of E does not catch, everyone depending on any of the deps in the chain are at risk.
It's why the JavaScript ecosystem of micro packages is absolutely insane. If someone infected isEven, they'd have a blast radius of 90% of JavaScript devs.
It's much like having a single password protecting everything. JavaScript has way too many of these high value packages that find their way into every modern JavaScript project.