Malicious crossenv package on npm
Friendly reminder, every time this happens...<p><a href="https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;npm&#x2F;pull&#x2F;4016" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;npm&#x2F;pull&#x2F;4016</a><p>&quot;However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shasum check npm already has.&quot;<p>I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to &quot;better solutions&quot; that don&#x27;t exist and will never exist.<p>They&#x27;ve done literally nothing.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;node-forward&#x2F;discussions&#x2F;issues&#x2F;29" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;node-forward&#x2F;discussions&#x2F;issues&#x2F;29</a><p>Last discussion was &gt; 1 year ago. They simply do not care. Security isn&#x27;t even an afterthought.