DEV Community

Discussion on: npm package discovered to have bitcoin-stealing backdoor

Collapse
 
rhymes profile image
rhymes

Also keep in mind that huge companies and small startups alike all basically depend on the same graph of packages, and nobody noticed in time.

I still can't believe that the maintainer of the package is also the maintainer of other hundreds of packages, that's absurd. Nobody should be in charge of so many dependencies by themselves