Re:Active NPM supply chain attack: Tinycolor and 40 Packages...
by wrs on Tuesday September 16, 2025 @04:04PM
(#45267258)
It is by package name, but at least you won't be surprised when left-pad suddenly has an install script.
You can put a fingerprint on the package dependency itself, though, so if you add a fingerprint to anything you approve the install script for, you will get that level of safety.
You can put a fingerprint on the package dependency itself, though, so if you add a fingerprint to anything you approve the install script for, you will get that level of safety.