News for hackers. Stuff that matters.

A comment on NPM packages from Red Hat have been compromised. Parent comment

Re:NPM packages from Red Hat have been compromised by isityettime on Monday June 01, 2026 @11:26AM (#48358122)
Yeah with RPM and dpkg you're trusting the distro, or maybe individual distro maintainers, depending on how you consider it. But there are norms in the distro about what those scripts are for and how to use them, and there's some social enforcement around that.

The real issue for hooks in packaging formats like those is when you start adding third-party vendor repositories, e.g., Zoom, Google Chrome, Discord. None of the social enforcement mechanisms are there and the companies behind the products I just mentioned all have histories of abusing them.

That's why it's generally better to use Flatpak for things like that if your distro itself doesn't include them.

[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by nailer on Monday June 01, 2026 @11:53AM (#48358541)
> Yeah with RPM and dpkg you're trusting the distro, or maybe individual distro maintainers, depending on how you consider it.

Not all packages come from the distro. People can and do enable external sources for software that isn't part of their OS.

[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by isityettime on Monday June 01, 2026 @05:54PM (#48363176)
Read the third sentence in the comment you're ostensibly replying to, friend.
[ Parent | on HN ]