Post

The npm self-replicating worm, in one line: "The attacker did not break npm. They broke the process that npm trusts. The fix is not stronger locks on the registry door, it is harder locks on the publishing pipeline itself." #npm #supplychain