dkmb

Correct, I was referring to the original linked article/disclosure.

Reading the blog, it sounds more like they were depending on libraries (both by Cyphernet, interestingly) and implicitly trusting them, instead of verifying.

Which I can understand to an extent with large, high-traffic dependencies but these were really low traffic projects with like 10 stars on github and barely any development... Well, hindsight is 20/20.

Equating memorizing import paths - something IDEs have been doing automatically for decades now - to 'basic ability' might be the dumbest thing I've read this year.

It's a valuable skill to recognize which knowledge is important, and which is fluff you shouldn't waste cycles on. Knowing what a hashmap is useful for, when to use it, and when it's suboptimal, is important. Memorizing import paths is not.

I uhh.. what?

Check the URL of the archived thread.