Quote from: promise444c5 on Today at 12:23:14 AM

Quote from: d_eddie on September 08, 2025, 10:58:58 PM

Ledger have already proved their clownmanship, but this is preposterous. Don't they checksum the libraries? Can just anyone push bogus stuff on github or wherever it is that the code is kept? I think there's something I'm missing.

It needs to be accepted by the developer but GitHub itself allows any code to be stored in a repository..people can report a repo if it contains malware or similar threats though .

For libraries, npm packages aren’t directly dependent on the repositories. What actually happened was that new versions were published under Qix-’s account (after it was hijacked) even though there were no updates on the GitHub repositories.

His latest update was that he has regained access to his account, but he believes other maintainers may have been compromised as well, that was about an hour ago

How it started:

Damn!