undefined | Better HN

0 pointsoever18d ago0 comments

That means going back to disabling Javascript or only allowing widely used, well-maintained Javascript libraries.

0 comments

> or only allowing widely used, well-maintained Javascript libraries.

That isn't a guarantee either, just last month someone compromised the Axios library.

They stole the axios's npm keys and they uploaded malicious artifacts. They did not takeover the axios's repo. The issue is with packaging and distribution, not with code.

pocksuppet18d ago

What's the meaningful distinction between those two things? You imported axios, you got pwned. Same result either way.

1 more reply

j / k navigate · click thread line to collapse