Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by LtWorf on Monday April 13, 2026 @04:26PM (#47757384)

I generally limit myself to what's available in my distribution, if the standard library doesn't provide it. But normally I never use requests because it's not worth it I think to have an extra dependency.

[ Parent | on HN ]

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by K0IN on Monday April 13, 2026 @06:28PM (#47758770)

This might hold true for easy deps, but (let's be honest who would install is promise) if you have complex or domain specific stuff and you don't have the time to do yourself or the std lib does not have anything then yeh you might still fall into the pit, or you have to trust that the library does not have an supply chain chain issue itself.

[ Parent | on HN ]