Hacker News Reader

npm does something similar with their scoped packages. It fixes the problem for the top level packages, but you'd still have to contend with the transitive dependencies written by smaller organizations or individual contributors. In this case, you have to guarantee that no one involved in the dependency chain ever typos anything.

View on HN

"you'd still have to contend with the transitive dependencies written by smaller organizations or individual contributors" - generally these are the higher risk dependencies anyway and should probably be used with extra caution anyway.

This is true, and wouldn’t remove the entire space of attack, but would still limit it to some extent.

Oh absolutely. Unless everyone wants to be cool and stop publishing malware, gotta take a defense in depth approach here.

Reply on news.ycombinator.com