Malicious code in the purescript NPM installer
Another reminder of how annoying it is for a package system to have unqualified package names.<p>Having to ask someone to gift a `purescript` package shouldn't even be a thing. It should've been `@shinn/purescript` and the compiler developers just create their own `@whatever/purescript`.<p>This is something Elm and many others got right. <a href="https://package.elm-lang.org/" rel="nofollow">https://package.elm-lang.org/</a> It's just infinitely, obviously better.<p>You see all sorts of problems because of this, like people "giving packages away" when they quit. Or buying package names. Or coming up with annoying name hacks because the obvious, best name is simply taken. Or people thinking/guessing that `npm install mysql` is the correct/best/canonical package because it's the simplest name, and anyone who publishes a better library has to name it mysql2 or better-mysql, etc. These just shouldn't even be things.