Investing in Open Source Security - ASW #180

This isn't a story about NPM even though it's inspired by NPM. Twice.

The maintainer of the "colors" NPM library intentionally changed the library's behavior from its expected functionality to printing garbage messages. The library was exhibiting the type of malicious activity that typically comes from a compromised package. Only this time users of the library, which easily number in the thousands, discovered this was sabotage by the package maintainer himself.

This opens up a broader discussion on supply chain …

open source security