Ledger library confirmed compromised and replaced with a drainer
twitter.com
twitter.com
And then if you install a malicious package that phones home, you might get an alert.
Of course this doesn't guarantee anything, as the package might activate the malicious behavior only under some specific circumstances. But it also doesn't cost anything. So it's a small win in my book.
Here's how it works in practice:
https://askubuntu.com/questions/1145649/apt-strange-requests...
--note this part in the accepted answer:
> they are surprised that more people hadn't noticed the behavior in the past.
My guess is that it won't for most, because convenience and expedience seem more rewarding than safety and diligence.
Solutions like lavamoat have been proposed and implemented in places, but they will not scale to the entire industry. There's a bigger problem in how innovation speed / developer convenience is inversely related to security.
In many cases it's literally cheaper to just wait for an attack and make victims whole. And even if not, it's hard to explain to your investors why it takes you half a year to build a product that took your competitors a month, so you just pretend the threat doesn't exist.
Come on. This sensitive an application using a CDN at all, let alone a URL without version pinning?