NPM publish-time malware scanning and dual-use metadata

3 comments

• $exploraz 3 hours ago

  Earlier: https://news.ycombinator.com/item?id=49092172

• $Hackbraten 4 hours ago

  > a package may be published as […] held for manual review

  Manual review by whom?

  [-]
  • $Bobaso 4 hours ago

    Microsoft owns NPM. Microsoft employee I guess ?