Karna@lemmy.ml to Linux@lemmy.ml · 2 months agoArch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Haltedwww.phoronix.comexternal-linkmessage-square72linkfedilinkarrow-up1201arrow-down13cross-posted to: linux@sh.itjust.works
arrow-up1198arrow-down1external-linkArch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Haltedwww.phoronix.comKarna@lemmy.ml to Linux@lemmy.ml · 2 months agomessage-square72linkfedilinkcross-posted to: linux@sh.itjust.works
minus-squarechgxvjh [comrade/them, he/him]@hexbear.netlinkfedilinkEnglisharrow-up3·2 months agoNpm doesn’t let you easily take over packages you don’t own.
minus-squareCysio@lemmygrad.mllinkfedilinkarrow-up2arrow-down1·2 months agobut does let you take over their maintainers’ accounts (through poor security) and easily poison them
minus-squarechgxvjh [comrade/them, he/him]@hexbear.netlinkfedilinkEnglisharrow-up2·2 months agoNot more easily than anything else.
Not the only repo, see: npm
Npm doesn’t let you easily take over packages you don’t own.
but does let you take over their maintainers’ accounts (through poor security) and easily poison them
Not more easily than anything else.