Hacker News Reader

There are remarkably few dependency management systems not vulnerable to some variant of this attack.

Then again, a project with <20 dependencies has fewer "entry points" for this attack than a typical NPM project with 500+ transitive dependencies.