Devs unknowingly use “malicious” modules snuck into official Python repository
The casual culture of pulling in hundred of dependencies, and mushrooming language specific package managers is ridiculously insecure and has to go.There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable.If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form as a deployment artifact.There are already secure distribution package managers with the necessary infrastructure, you are not special, use those. Ruby is already paying a price for imposing dependency hell of users and wasting millions of man hours. Many have suffered and do not even bother with Ruby apps anymore. Node and others who think this is a good model will be next. Users should simply boycott such user hostile developers and languages that encourage this kind of insecurity.