Oh dear, the situation with the Arch Linux AUR got a fair bit worse since GamingOnLinux initially covered the malicious packages.
  • Mihies@programming.dev
    3·
    1 hour ago

    Good luck with checking all dependencies as a developer, bonus points for JavaScript. You’ve just become a 98% less effective. But seriously, how would you check everything? And if you stumble upon malicious code, would you even recognize it?

    • HaraldvonBlauzahn@feddit.org
      1·
      22 minutes ago

      Good luck with checking all dependencies as a developer, bonus points for JavaScript.

      Yes I know well that JavaScript development practices are unsustainable.

      And at some point, chickens will come home to roost.

      For my part, I focus on minimalist, well defined systems, both as a user and developer. And trust where it is reasonable - not by default.

    • Victor@lemmy.world
      1·
      46 minutes ago

      Exactly, I wouldn’t know what I was looking at probably. We don’t really learn malicious programming at uni.