一个周下载量200万的npm包被恶意代码注入，你中招了吗？
-
如果你是一个nodejs的开发者，你需要注意了：
参见这里：https://github.com/dominictarr/event-stream/issues/116
最麻烦的是，至今还不清楚会造成什么破坏
原始开发者将代码维护权移交给了他人，而这个人本不该信任。原始开发者有责任吗？
原始开发者的声明：
https://gist.github.com/dominictarr/9fd9c1024c94592bc7268d36b8d83b3a
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login