News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by kelnos on Tuesday September 16, 2025 @03:48PM (#45267055)
This doesn't really help you. I assume Go records the sha1 hash of the commit it grabs, so it doesn't really matter if you vendor it, or download it every time.

The problem comes when you want to upgrade your dependencies. How do you know that they are trustworthy on first use?

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by cyberax on Tuesday September 16, 2025 @04:05PM (#45267273)
Go uses the hash of the source code, not the commit ID. So there's no difference between vendoring and using the central repo.
[ Parent | on HN ]