Software downloaded 30k times from PyPI ransacked developers’ machines (arstechnica.com)

While this is a logistical problem and people generally don't check code in the dependency tree, I already fear the security mechanisms that might spawn from this.

crev is an open-source framework trying to fix this, using a web-of-trust approach to reviews: https://github.com/crev-dev/

Currently only available for Cargo, Rust's package manager, but more integrative are being developed.

With the release of GitHub’s Copilot, I wonder how far we are from ML identification of malicious repositories.