Researchers found hijacked npm packages and 16 Go packages using fake font files and VS Code tasks to deploy a Python infostealer.
  • Kairos@lemmy.today
    1·
    18 days ago

    “Installing software installs software”-ass vulnerability. At least Go protects you by including checksums and hard versions of imported packages. NPM doesn’t.