Hundreds of code libraries posted to NPM try to install malware on dev machines (arstechnica.com)
from mox@lemmy.sdf.org to programming@programming.dev on 05 Nov 03:39
https://lemmy.sdf.org/post/24678589

#programming

threaded - newest

Flipper@feddit.org on 05 Nov 08:05 collapse

Let’s see how long it will alles Till Rust hast the same Problems.

wkk@lemmy.world on 05 Nov 19:17 collapse

Python with PyPI, C# with Nuget, Docker with Dockerhub, Java with Maven Central, hell even just regular Linux packages from dodgy repositories…

Supply chain attacks concern almost everything everyone everywhere.

mox@lemmy.sdf.org on 05 Nov 22:37 collapse

This is one of the more important reasons to minimize dependencies and be very picky about the ones we adopt.

3h5Hne7t1K@lemmy.world on 06 Nov 20:50 next collapse

Absolutely this. It almost seems like a controversial opinion sometimes, but microdependencies is a code smell imo. This could largely be improved by providing a more extended standard lib, at the cost of innovation and velocity maybe. I found this interesting: blessed.rs/crates

Acters@lemmy.world on 06 Nov 21:05 collapse

IDK about you but the company I work for can’t live without npm packages doing almost everything. For example: the is-even package.