Post #3300444
2026-06-12 11:30 UTC
Because the NPM is a complete mess and it’s super easy to exploit for supply-chain attacks by sneaking malware into one of the billion dependencies required by most popular packages.
Replies (2)
-
@placebo@lemmy.zip 2026-06-12 11:38
But if you look at some of the packages, they explicitly added npm as a new dependency. It’d be much easier to sneak in a python script.
-
@CommanderCloon@lemmy.ml 2026-06-12 12:21
But why would they care about supply chain attacks if they already have hacked into the package you’re requesting? In that case, executing python scripts would be less noticeable