from Hacker News

Code libraries posted to NPM try to install malware on dev machines

by dangle1 on 11/4/24, 11:45 PM with 1 comments

• by jocoda on 11/5/24, 7:00 AM

  ...“This is, once again, a persistent reminder that supply chain attacks are alive and well.”

  For NPM, github, etc, we're long past being able to just trust anything online, whether it's malign or just disinformation.

  I remember the first time I looked at server logs and nearly soiled myself with all the port scanning, and login hacks. Now, I'm all "meh - scriptkiddies..."

  I guess curation has to replace blind trust.