诈骗模式
Compromised package maintainers
An attacker publishes a malicious version through a legitimate package account.
研究文章和参考条目以英语发布。导航提供七种语言。
Overview
An attacker publishes a malicious version through a legitimate package account.
Why it matters
Normal publisher reputation and automated upgrades spread the payload.
What to check
Require signed, reproducible builds and record exact version and publication time.