News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by marcus_holmes on Monday September 08, 2025 @10:33PM (#45176729)
I have repeatedly been met with derision when pointing out what a gaping security nightmare the whole Open Source system is, especially npm and its ilk.

Yet here we are. And this is going to get massively worse, not better.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by Intermernet on Tuesday September 09, 2025 @05:39AM (#45179724)
Nothing specific to open source is to blame in this instance. The author got phished. Open source software often has better code vetting and verification than closed source software. npm, however, does not.
[ Parent | on HN ]