Backdoored images downloaded 5M times removed from Docker Hub
I wonder how much malicious code like this is doing its work deep down in the endless pyramid of npm dependencies.<p>And how much as-of-now clean code will turn into malicious code when bad guys take over npm repos in the future.<p>It might be possible to tackle this issue by some intelligent trust algo that combines a trust rank similar to google-page-rank and signed messages.<p>Say somebody pushes an update to their repo. Now the first user of it might read it and sign it with 'Looks OK /Joe'. And the next user sees the signed message by Joe in some kind of package-review-message list. Based on all the reviews and the trust of the reviewers, they then can calculate a trust score for the update.