Hacker News new | ask | show | jobs
by loic-sharma 1172 days ago
Google search is an extremely common way to discover packages. Disabling indexing entirely isn’t a valid solution.

Downloads are very easy to fake. Usually package managers don’t allow indexing until the package and its author reach a certain age. This allows the team to discover and remove the package before it is indexed.