Hacker News Reader

The packages served to the vendor could be legit, but packages served to everyone else is compromised. The vendor would never know there was a problem.

View on HN

One could use hash signatures to detect a problem.

The hash comes from the source of the package, and in this attack that source was compromised. The malicious code was signed.

Reply on news.ycombinator.com