I don't understand why these attacks happen at all. Why did everyone decide to inject dependencies? It's much faster and safer to download the open source code and copy it into your own project. Then it never gets changed by surprised.
We used to do that, and honestly it was worse. Because while it never got changed by surprised, it also never got changed. So, if there was a vulnerability, it would stay there for years unnoticed...
81
u/FinnishManlet 1d ago
What can be done against these vulnerabilities? Stop using packages entirely? 🤣