It's Open Source! - eviltoast

Not discrediting Open Source Software, but nothing is 100% safe.

  • nous@programming.dev
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    What about the various NPM packages written by one guy. Who then moved on to other things then gave control of that package to someone else that seemed legit. Only for them to slowly add melicious code to that once trusted package that is used by a large number of other packages?

    Or someone raising a pull request for a new feature or something that on the surface looks legit on its own. But when combined with other PRs or existing code ends up in a vulnerability that can be exploited.