TIL: Your internal npm package name is a loaded gun

I was poking at a web app for a security assessment this week and ran a quick check on one of its dependencies, redacted-generic-plugin-name. Sounds real. Plausible. I curled the registry.

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town