Oh dear, the situation with the Arch Linux AUR got a fair bit worse since GamingOnLinux initially covered the malicious packages.
  • Mihies@programming.dev
    11·
    17 hours ago

    Good luck with checking all dependencies as a developer, bonus points for JavaScript. You’ve just become a 98% less effective. But seriously, how would you check everything? And if you stumble upon malicious code, would you even recognize it?

    • devfuuu@lemmy.world
      53·
      13 hours ago

      Nobody sane should be installing js code in their systems. Nor having node or even npm installed.

    • HaraldvonBlauzahn@feddit.org
      32·
      16 hours ago

      Good luck with checking all dependencies as a developer, bonus points for JavaScript.

      Yes I know well that JavaScript development practices are unsustainable.

      And at some point, chickens will come home to roost.

      For my part, I focus on minimalist, well defined systems, both as a user and developer. And trust where it is reasonable - not by default.

    • Victor@lemmy.world
      1·
      16 hours ago

      Exactly, I wouldn’t know what I was looking at probably. We don’t really learn malicious programming at uni.