|
|
|
|
|
|
by lytefm
767 days ago
|
|
|
Early this year, I've received a hostile PR for a "maintenance only" JavaScript authentication library with less than 100 stars but which is actively used by my employer. It added a "kinda useful but not really needed" feature and removed an unrelated line of code, thereby introducing a minor security vulnerability. My suspicion is that these low quality PRs are similar to the intentional typos in spam emails: Identify projects/ maintainers who are sloppy/ gullible enough and start getting a foot in the door. |
|
|