PyPi, but yes. https://securitylabs.datadoghq.com/articles/guarddog-identif.... The link also mentions that PHP has been attacked in this way.
As has rust. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustde...
As has rust. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustde...
NPM wants to have its cake and eat it too, which is the problem here. The solution is just to say that if you publish a package to NPM you give it the perpetual right to distribute it as-is, and then remove the ability for users to delete their packages at-will.
So many issues arise from the fact that our UIs can’t do simple things on lists like folders (e.g. archive) and tags/notes.
Yes, exactly!
Kind of unrelated, but I think it is important to remember that the left-pad was also ENTIRELY npm team's fault. You can't just take away a namespace from someone just because some startup like kik comes knocking.
Toyota does not have a right to my domain dot tld slash toyota The correct answer would have been npm to tell kik to pound sand.
npm has never fixed this grave error.
https://blog.npmjs.org/post/141577284765/kik-left-pad-and-np...
> We stand by our package name dispute resolution policy, and the decision to which it led us.
npm deserves to die.
The way PyPI does deletions is through "yanking," which is really a soft-delete mechanism. Yanking prevents usage of a particular package version for new resolutions, but allows fully-resolved versions to be downloaded. As a result, PyPI doesn't have the specific behavior that caused this (forbidding people from removing their packages because removal means hard-deletion).