It's tuesday, so shai hulud is back and packages with ~2bn/mo installs have been compromised againhttps://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
>>109458879Update is the new security
Why don't they just have AI scanning each upload for malware?
>>109458879so I assume this is a nothing burger cause the "major organizations" they mention are literal whos. no large framework affected as it appears.
UPDOOTERS BTFO ONCE AGAIN
>>109459513It probably complex, the scripts are supposed to do many things and node developers are known run cross dependencies on a one liner projects to 100k line project
In rust, this is just cargo add shai-hulud.
>>109458879That's why i would never touch something as pozzed as node.js or Python.
How many more times will this happen until they figure out a better way for distribution
node trannies, not like thisnot like this
