Re:NPM packages from Red Hat have been compromised
by ChocolateGod on Monday June 01, 2026 @10:59AM
(#48357703)
> apt/dnf scripts run on packages a maintainer signed and a distro gatekept
Unfortunately apt/dnf isn't much better here because random tutorials online suggest people add random repositories where the creator of any repository effectively has root access to anyone machine that adds it as a remote.
Re:NPM packages from Red Hat have been compromised
by Zardoz84 on Monday June 01, 2026 @12:08PM
(#48358742)
It's the exact same problem when random tutorials (and official pages) recommend to do a curl "URL" | bash to install something. Every time that I see it, I look it suspicious.
Unfortunately apt/dnf isn't much better here because random tutorials online suggest people add random repositories where the creator of any repository effectively has root access to anyone machine that adds it as a remote.