诈骗模式
Poisoned software dependencies
A familiar or mistyped package adds key theft or transaction manipulation to a build.
研究文章和参考条目以英语发布。导航提供七种语言。
人物与项目
Overview
A familiar or mistyped package adds key theft or transaction manipulation to a build.
Why it matters
Users are reached through a developer's supply chain.
What to check
Pin versions, inspect lockfile changes and preserve package hashes and provenance.