Malicious crossenv package on npm
Friendly reminder, every time this happens...<p><a href="https://github.com/npm/npm/pull/4016" rel="nofollow">https://github.com/npm/npm/pull/4016</a><p>"However, this is just a piece of an overall solution, and it brings with it a lot of the baggage that comes along whenever GnuPG or PGP get involved. Without a web of trust (sigh), a PKI (ugh), or some other mechanism to tie identities to trust metrics, this is essentially a complicated, very expensive, and fragile version of the shasum check npm already has."<p>I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist.<p>They've done literally nothing.<p><a href="https://github.com/node-forward/discussions/issues/29" rel="nofollow">https://github.com/node-forward/discussions/issues/29</a><p>Last discussion was > 1 year ago. They simply do not care. Security isn't even an afterthought.