THE MASSIVE BUG AT THE HEART OF THE NPM ECOSYSTEM

Summary from the TLDR Web Dev newsletter

Darcy Clarke, a former npm CLI team manager, discusses a critical issue in the npm ecosystem known as "manifest confusion." This issue arises from the independent publishing of an npm package's manifest and its tarball, without full validation of their contents against each other. This loophole allows potential exploitation by bad actors, leading to hidden malware, unknown dependencies, and potential downgrade attacks.