kjok

I should have been clearer and specific: state management is done on the backend, but collecting behavioral biometrics and device fingerprint is done using JavaScript, which can be manipulated.

Adversaries do not have to wait for LLM models to evolve to mimic human process, they can simply evade the detection JavaScript that evaluates similarity. JavaScript is visible, can easily be reverse-engineered.

Please also collect responses from people, you'd find a pattern: a new attack is launched, people make noise, and later go back to installing packages the same way. Enterprises already use private registries to combat such attacks, vulnerable folks include individual devs and small teams.

> Compare this to Android where you can run malware and it cannot do anything except for annoying you with notifications.

Are you sure it cannot do anything? Looking through various past malware/exploits, this doesn't seem to be the case.

Why should they be open source?

Cooldown sounds like a good idea ONLY IF these so called security companies can catch these malicious dependencies during the cooldown period. Are they doing this bit or individual researchers find a malware and these companies make headlines?

How difficult is it to build a second startup on the side?

Are you a bot?

Building automated analysis tool that help identify the use of GPL-licensed SDKs in mobile apps, promoting license compliance and supporting sustainable open-source development.

How do you know that they were LLM scrapers? The reason I ask is because user agents could easily be spoofed?

For those who have deployed Cloudflare in front, what are pros and cons? How's the user experience? Do they offer free bot protection?

How are you measuring this? Does your solution rely on user agent or device fingerprinting? Curious to know what tools are available today and how accurate they are.