Someone left this on my last post: I'd also treat the "404 means stop" rule as only the first gate. A package resolving successfully doesn't establish that it is trustworthy. For newly registered packages that closely match common model-generated names, provenance and publication history become useful signals too. The deeper lesson is that agents... Weiterlesen: A 404 is the easy half. Scoring a package that actually exists is whe…
Intelligence View
⚡ tsecurity.de Intelligence
A 404 is the easy half. Scoring a package that actually exists is where we got it wrong.
Someone left this on my last post: I'd also treat the "404 means stop" rule as only the first gate. A package resolving successfully doesn't establish that it…