Backdoored images downloaded 5M times removed from Docker Hub
I wonder how much malicious code like this is doing its work deep down in the endless pyramid of npm dependencies.And how much as-of-now clean code will turn into malicious code when bad guys take over npm repos in the future.It might be possible to tackle this issue by some intelligent trust algo that combines a trust rank similar to google-page-rank and signed messages.Say somebody pushes an update to their repo. Now the first user of it might read it and sign it with 'Looks OK /Joe'. And the next user sees the signed message by Joe in some kind of package-review-message list. Based on all the reviews and the trust of the reviewers, they then can calculate a trust score for the update.