NPM could also flag releases that don't have a corresponding github tag (for pac... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		kaelwd 29 days ago \| parent \| context \| favorite \| on: DuckDB NPM packages 1.3.3 and 1.29.2 compromised w... NPM could also flag releases that don't have a corresponding github tag (for packages that are hosted on github), most of these attacks are publishing directly to NPM without any git changes.

mdaniel 29 days ago [–]

I would love this for every dependency manager, and double extra bonus for "the tag NOW isn't the tag from when the dep was published"

But, this coming from GitHub, who believe that sliding "v1" tags on random action repos is how one ends up with https://news.ycombinator.com/item?id=43367987

Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact