Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by hgoel on Monday April 13, 2026 @04:07PM (#47757178)

I think we've pulled way too much towards "software must be a constantly maintained, living item, and users should update often", thus the recklessness with dependencies. This has also exacerbated the other aspects of dependency hell. But not only does this not match reality, it makes projects very vulnerable to this supply chain hijacking stuff.

I think maybe the pendulum needs to swing back a little to being very selective about adding dependencies and expecting releases to be stable for the long term. Users shouldn't have to worry about needing to hack around code that was written just 3-4 years ago.

[ Parent | on HN ]

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by xmcqdpt2 on Tuesday April 14, 2026 @07:30AM (#47764208)

From a purely aesthetic point of view, this is what I enjoy so much about C and Fortran. You look up a Rust crate and it hasn't been touched in 5 years. That means it's unmaintained and unusable, don't add it to your project or you will have a bad time.

You find a C or fortran library that hasn't been touched in 20 years and (sometimes) it's just because it's complete and there hasn't been any reason to update any parts of it. You can just add it to your project and it will build and be usable immediately. I wish we had more of those.

[ Parent | on HN ]

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by dgb23 on Tuesday April 14, 2026 @08:02AM (#47764498)

Clojure and Go are similar to this from my experience.

[ Parent | on HN ]