Hacker News new | past | comments | ask | show | jobs | submit
insanitybit | on: Keyv and friends compromised in active Shai-Hulud supply chain attack
Arguably crates.io is worse. NPM has cooldowns and has for a while, it has had Trusted Publishing for longer, it has human-approved releases that separate CI/CD from actual publishing. Ruby is probably worse in every way.
woodruffw | parent
RubyGems actually adopted Trusted Publishing before both npm and crates.io. To my recollection, they were second after PyPI.

(I have no opinion about the overall security posture of these indices.)

insanitybit | root | parent
No build script control though.
loading story #49172282