Small discussion (31 points, 6 months ago, 9 comments) https://news.ycombinator.com/item?id=41703726

Recently (31 points, 10 days ago, 6 comments) https://news.ycombinator.com/item?id=43664538

It seems like a natural response to using AI for package spoofing is to use AI to look for malware in each release of each package. It's a red queen's race, so we'll never win, but we lose if we don't run.