News for hackers. Stuff that matters.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by staticassertion on Tuesday March 31, 2026 @12:48PM (#47590126)
The people building package managers are unaware of these problems going into it and it becomes extremely disruptive to start adding these things later on since your entire ecosystem is built on the assumption that they can do these things.

It's also shockingly controversial to suggest typosquatting suggestions. I made this suggestion ages ago for cargo, demonstrated that basic distance checks would have impacted <1% of crates over all time, and people still didn't want it.

There are no comments on this comment yet.