Shai Hulud 2.0 Strikes Again: Malware Supply-Chain Attack Hits Zapier & ENS Domains

Another "supply chain" attack focusing on npm packages. It is an interesting read and it is really scary how easily these attacks work. This really is one of the biggest challenges of large open source ecosystems — you don't have a clear understanding of who made what and if it is authentic. This is totally solvable using public key cryptography and code signing. But there is a big challenge in doing that since it challenges many of the open concepts of open source software. As an industry though, we need to get this figured out and probably make some tradeoffs.