Unsurprisingly ends up with an advertisement for their own security tool. That said the vector used for the attack is interesting, with more npm like ecosystems available nowadays, should we expect to see more such attacks?

Nice automation for such updates. I'm discovering endoflife.date this looks very handy.

A good explanation of why you likely don't want a centralised package manager for your ecosystem.

Good idea to standardise this for vendors just like we do using CVEs for software components. This would definitely improve dealing with breaches.

Bad actors will go to great length to try to compromise your supply chain.

It's indeed surprising that this compromised npm account didn't lead to more damage. It's a good reminder that you better regularly audit what happens in your ecosystem.

Sometimes, it's indeed better to not pull an extra dependency.

Mind your typos... It seems clear a bad actor is hiding behind that one.

Not strictly about Rust, still is shows how to approach the conversation about your dependencies. It also gives good ideas on how to try to reduce them.

I'm not sure this dichotomy is enough for building a taxonomy of FOSS projects. But I guess it's a start and captures something often missing in other such attempts.

For studying it makes sense. But don't shun other's work away only because of trust or ego issues.

There's clearly a tension between security and ease of pulling dependencies. In a way, it's "too easy" with cargo and you very quickly end up having to trust a staggering amount of third party code.

Dependency resolution is harder than people generally expect. This is a difficult problem and is very sensitive to the context.

Indeed there is a tension between both approaches in package ecosystems.

This is a worthy questioning... We try to reuse, but maybe we do it too much? For sure some ecosystems quickly lead to hundreds of dependencies even for small features.

The browser extension ecosystems are definitely a weak link in term of security. Better not have too many random extensions installed.

There is some good advice in this piece. If you want to maintain something for a long time, some aspects need to be thought out from the beginning.

Interesting report, some findings are kind of unexpected. It's interesting to see how much npm and maven dominate the supply chain. Clearly there's a need for a global scheme to identify dependencies, hopefully we'll get there.

It's tempting to use uv. It's probably fine on the developer workstation at this point. It looks a bit early to use it in production though, it's a bit young for that and carries questions regarding supply chain security still.

Interesting comparison between old attempts at backdooring OpenSSH and the latest xz attempt. There are lessons to be learned from this. It makes a good case for starting to sandbox everything.