|
|
|
|
|
|
by po1nt
43 days ago
|
|
|
In my opinion you have no chance of identifying supply chain attack like this. It's not like you will see "evil-package": "*" in there. Supply chain attacks happen by appending obfuscated code deep into dependency no one knew you had in the first place. |
|
|