Mac@programming.dev to Programming@programming.dev · 11 months agoSSH keys stolen by stream of malicious PyPI and npm packageswww.bleepingcomputer.comexternal-linkmessage-square10fedilinkarrow-up1125arrow-down12cross-posted to: hackernews@derp.foo
arrow-up1123arrow-down1external-linkSSH keys stolen by stream of malicious PyPI and npm packageswww.bleepingcomputer.comMac@programming.dev to Programming@programming.dev · 11 months agomessage-square10fedilinkcross-posted to: hackernews@derp.foo
minus-squareplatypus_plumba@lemmy.worldlinkfedilinkarrow-up1·11 months agoIt’s honestly crazy that tools like npm don’t force you to encrypt the tokens for the npm repos. They don’t even support it. Any stupid read_file() with http.post() can screw 1000 people.
It’s honestly crazy that tools like npm don’t force you to encrypt the tokens for the npm repos. They don’t even support it. Any stupid read_file() with http.post() can screw 1000 people.