News for hackers. Stuff that matters.

A comment on NPM packages from Red Hat have been compromised. Parent comment

Re:NPM packages from Red Hat have been compromised by saturn_vk on Monday June 01, 2026 @11:04AM (#48357789)
IIRC, go cannot run arbitrary code at build time, so that should not make it vulnerable
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by matheusmoreira on Monday June 01, 2026 @11:09AM (#48357875)
That changes nothing. If you're downloading packages pushed by randoms, then it's vulnerable. There is no escaping it. Go's module index is filled with people's GitHub repositories. You have no idea what's inside those things unless you review the source yourself.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by gus_ on Monday June 01, 2026 @03:53PM (#48361763)
https://www.reddit.com/r/neovim/comments/1j45stl/someone_wro...
[ Parent | on HN ]