What are you using that utilizes Apple containers?
replyThe problem is that package managers are a distraction. You have to sandbox everything or else it doesn't work. These attacks use post-install hooks for convenience but nothing would have stopped them patching axios itself and just waiting for devs to run the app on their local workstation. So you end up needing to develop in a fully sandboxed environment.
replyThey are not a distraction when they are also the command runners.
replyYeah the whole rush on "post-run hooks bad" isn't really adding all that much to security.
replyLike congratulations, your dev was compromised whole 10 minutes later after he ran code.