News for hackers. Stuff that matters.

A comment on DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware. Parent comment

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by mdaniel on Tuesday September 09, 2025 @10:08PM (#45192236)
I would love this for every dependency manager, and double extra bonus for "the tag NOW isn't the tag from when the dep was published"

But, this coming from GitHub, who believe that sliding "v1" tags on random action repos is how one ends up with https://news.ycombinator.com/item?id=43367987

[ Parent | on HN ]

There are no comments on this comment yet.