News for hackers. Stuff that matters.

A comment on Tarmageddon Open Source Abandonware.

Re:Tarmageddon Open Source Abandonware by lvass on Saturday October 25, 2025 @10:26PM (#45708657)
Why didn't crates.io maintainers apply the patch themselves? NPM does meddle with packages when an incident happens like they did with left-pad.
[ Parent | on HN ]
Re:Tarmageddon Open Source Abandonware by woodruffw on Saturday October 25, 2025 @11:16PM (#45708871)
I think that would be pretty disruptive, and would break some assumptions around crate integrity that are deeply held.

My understanding is that the left-pad incident is not directly analogous, since it involved restoring a deleted package rather than modifying an extant package.

[ Parent | on HN ]
Re:Tarmageddon Open Source Abandonware by eviks on Sunday October 26, 2025 @02:58AM (#45709693)
Do you have a more relevant example of meddling besides a binary block/publish?
[ Parent | on HN ]