Published VS unpublished // registered vs unregistered

[Tamas_Papp]

No, registered packages are not checked in detail. You may be interested in

Pkg: attack vectors

Pkg ecosystem: Learning from other's mistakes has gotten a bit long and wandering, as these discussions tend to. I’d like to have a very focused thread about attack vectors against the security of the package ecosystem. To that end, here are the attack vectors I’ve come up with so far. What are some other attack vectors? Attack: find an existing bug in some package that you can exploit Mitigation: fix the bug yank versions that have it Prevention: testing fuzzing basically anything that …