NPM packages from RedHat have been compromised | Hacker News

A Hacker News thread on compromised npm packages linked to Red Hat widened into a debate about package-manager security.

Commenters argued that npm’s default of running package scripts as the logged-in user increases supply-chain risk.

Others noted that similar security issues exist across ecosystems like Cargo, PyPI, NuGet, and AUR.

Proposed mitigations included opt-in scripts, minimum package age, and release cooldowns to reduce attack impact.