Cited on HN 3 times, 2016–2017, never outright recommendedscore 0
Years with an HN recommendation, 2007–2026
The speaker and others cite it in threads about malicious packages and typosquatting.
Rory McCune's AppSec EU 2015 talk on security risks in modern software deployment. It covers weaknesses in package ecosystems like npm, RubyGems and PyPI, and repository compromise.
“I did a talk last year for OWASP AppSecEU that covers this kind of thing.” (HN, 2016)
Kind of amusing that this is considered to need a new vuln. report, I kind of assumed it was common knowledge. Most of the programming language package repositories (e.g. npm, rubygems, PyPi, NuGet) have this kind of installation process and limited/no checks for malicious content. Also as there's no consistent use of package signing by the developer (it's either unsupported or not very used) there is also a risk of the repository itself being compromised. I did a talk last year for OWASP AppSecEU that covers this kind of thing. [this video]
Talk on risks of npm, rubygems, PyPI style package installation and repository compromise.
For me they're very similar. I actually did a talk last year for OWASP AppsecEU where I started with the curl|bash bit and pointed out where rubygems/npm etc aren't really a lot better in some ways [this video]
Compares curl|bash with package managers like rubygems and npm on security.
This isn't, in any way, a new problem. I did a presentation on this topic for OWASP AppSecEU 2015 ( [this video] ) and when doing the research for that I encountered cases of repo. attacks and compromise. IME the problem will continue unless the customers (e.g. companies making use of the libraries hosted) are willing to pay more for a service with higher levels of assurance. The budget required to implement additional security at scale is quite high, and probably not a good match with a free (at point of use) service.
Presentation on repository attacks and compromise in software package ecosystems.
Video list and Hacker News comment labels from HackerTube (prompted by @karpathy), released under ODC-By 1.0, built on the open-index/hacker-news archive. Hacker News data is provided by Y Combinator; comments remain the work of their authors. Video titles, channel names and thumbnails belong to their creators and are shown via YouTube. HackerTube Watch is an unofficial edition. Data export of 2026-10-31.
Plays via YouTube's privacy-enhanced embed
3 Hacker News comments
From the HN archive; up to 20 kept per video, favoring different commenters. Recommendations first.