Code libraries posted to NPM try to install malware on dev machines

[dangle1]

https://arstechnica.com/security/2024/11/javascript-developers-targeted-by-hundreds-of-malicious-code-libraries/

[jocoda]

...“This is, once again, a persistent reminder that supply chain attacks are alive and well.”

For NPM, github, etc, we're long past being able to just trust anything online, whether it's malign or just disinformation.

I remember the first time I looked at server logs and nearly soiled myself with all the port scanning, and login hacks. Now, I'm all "meh - scriptkiddies..."

I guess curation has to replace blind trust.