Re:Over 100k Infected Repos Found on GitHub
by mgii on Thursday February 29, 2024 @09:33AM
(#39549775)
To be fair, the kind of programmer who would include an infected repo is almost everyone. Many infected repos have no indicators except for username to help you notice without a careful examination, especially in niche repos. When you have to move fast, it's natural to make such mistakes.
[ Parent
| on HN ]
Re:Over 100k Infected Repos Found on GitHub
by cogman10 on Thursday February 29, 2024 @10:06AM
(#39550286)
Further, transitive dependencies are a real risk. If A depends on B depends on C depends on D depends on E depends on F, and F is compromised which the author of E does not catch, everyone depending on any of the deps in the chain are at risk.
It's why the JavaScript ecosystem of micro packages is absolutely insane. If someone infected isEven, they'd have a blast radius of 90% of JavaScript devs.
It's much like having a single password protecting everything. JavaScript has way too many of these high value packages that find their way into every modern JavaScript project.