News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by ptx on Tuesday September 16, 2025 @09:18AM (#45261851)
NPM lock files seem to include hashes for integrity checking, so as long as you check the lock file into the VCS, what's the difference?
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by cxr on Tuesday September 16, 2025 @09:32AM (#45262037)
Wrong question; NPM isn't bedrock. The question to be answered if there is no difference is, "In that case, why bother with NPM?"
[ Parent | on HN ]