> One key shift is there is no packager anymore. Its just - trust the publisher.... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		zahlman 4 days ago \| parent \| context \| favorite \| on: Shai-Hulud Returns: Over 300 NPM Packages Infected > One key shift is there is no packager anymore. Its just - trust the publisher. Repositories like NPM's, and PyPI, contain many more packages than any Linux distro. And the Linux Foundation actually gets funded.

calvinmorrison 4 days ago [–]

NPM isn't a package repository it's more akin a code repository.

There's a reason why most distributions dont ship upstream (except basically Arch)

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact