btaf45@lemmy.world to Technology@lemmy.worldEnglish · 2 days agoHundreds of code libraries posted to NPM try to install malware on dev machinesarstechnica.comexternal-linkmessage-square31fedilinkarrow-up1225arrow-down11cross-posted to: pulse_of_truth@infosec.pubprogramming@programming.devcybersecurity@sh.itjust.worksarstechnica_index@rss.ponder.cat
arrow-up1224arrow-down1external-linkHundreds of code libraries posted to NPM try to install malware on dev machinesarstechnica.combtaf45@lemmy.world to Technology@lemmy.worldEnglish · 2 days agomessage-square31fedilinkcross-posted to: pulse_of_truth@infosec.pubprogramming@programming.devcybersecurity@sh.itjust.worksarstechnica_index@rss.ponder.cat
minus-squareKairos@lemmy.todaylinkfedilinkEnglisharrow-up7·1 day agoOr at the very fucking least require specific versions with checksums, like golang.
minus-squareLavenderDay3544@lemmy.worldlinkfedilinkEnglisharrow-up2·14 hours agoI really think every package repository should be opt in and every publisher should be required to verify their identity and along with checksum verification for the downloaded files.
Or at the very fucking least require specific versions with checksums, like golang.
I really think every package repository should be opt in and every publisher should be required to verify their identity and along with checksum verification for the downloaded files.