On: Social engineering takeovers of open source projec...

[leeoniya]

yep.

same with npm. i publish releases of my OSS libs to npm, but there's no guarantee that what is uploaded is what you see on github. that's a lot of trust you have to put into my opsec, etc. not good.