←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0.418s | source
1. thedougd ◴[09 Sep 25 02:05 UTC] No.45176572[source]▶
It was a pain in the ass but I always appreciated that Maven central required packages to be signed with a public key pre-associated with the package name.