| ▲ | andrewl-hn 3 days ago | ||||||||||||||||
TBF it does happen to other package managers, too. There were similar attacks on PyPI and Rubygems (and maybe others). However, since npm is the largest one and has the most packages released, updated, and downloaded, it became the primary target. Similar to how computer viruses used to target Windows first and foremost due to its popularity. Also, smaller package managers tend to learn from these attacks on npm, and by the time the malware authors try to use similar types of attacks on them the registries already have mitigations in place. | |||||||||||||||||
| ▲ | shakna 3 days ago | parent [-] | ||||||||||||||||
PyPI is working towards attestation [0], and already has "Trusted Publisher" [1]. Ruby has had signed gems since v2 [2]. These aren't a panacea. But they do mean an effort has been made. npm has been talking about maybe doing something since 2013 [3], but ended up doing... Nothing. [4] I don't think it's fair to compare npm to the others. [0] https://docs.pypi.org/attestations/producing-attestations/ [1] https://docs.pypi.org/trusted-publishers/ [2] https://docs.ruby-lang.org/en/master/Gem/Security.html | |||||||||||||||||
| |||||||||||||||||