This is one of the scariest aspects to modern development. Thousands of applications are one bad actor away from ruin. We're incredibly vulnerable. Chrome extension gone rogue? Package repository allowed duplicate packages? A contributor's GitHub key was hijacked?
Imagine uBlock Origin's Chrome extension author creds were hacked. "He" publishes a new version of the Chrome extension that monitors coinbase.com and fakes the transfer/confirmation screen, or submits transfers in the background. The extension has "write" access on all sites, so the rogue extension can also monitor your Gmail and silently inject a filter that routes trade confirmations to trash.
Or the "requests" library in Python gets an update to replicate 2FA codes via Twilio to a 3rd party.
Sure, you can do pinning and cryptographic signatures to verify that v 1.0.0 of X is really what you expected.
We are one step away from very bad shit hitting the fan in a very painful way... so let's pretend everything's fine and try not to think about these things.
Imagine uBlock Origin's Chrome extension author creds were hacked. "He" publishes a new version of the Chrome extension that monitors coinbase.com and fakes the transfer/confirmation screen, or submits transfers in the background. The extension has "write" access on all sites, so the rogue extension can also monitor your Gmail and silently inject a filter that routes trade confirmations to trash.
Or the "requests" library in Python gets an update to replicate 2FA codes via Twilio to a 3rd party.
Sure, you can do pinning and cryptographic signatures to verify that v 1.0.0 of X is really what you expected.
But who audited 1.0.0 of X in the first place...?