Thomas Strömberg on Nostr: The recent NPM compromise highlights a frustrating reality: the security tools exist, ...

The recent NPM compromise highlights a frustrating reality: the security tools exist, but nobody uses them.

I had planned to keep my mouth shut about the affair, but someone DM'd me to ask if the supply-chain attack detection tools I created and open-sourced while at #Chainguard would have caught the attack. Yes—both malcontent and ucd detected it; the latter with surprising precision. [1/3]