A mobile app managing cryptocurrency, but does not sign all their release, and don't even react the situation quickly. Apparently they have no clue what they are doing in terms of security.
Since they also use react native, and npm is notorious for being exploit to distribute malware. I have a brief look at the package.json. Seems to be a typical javascript project where developers tend to put one more dependency for a simple feature rather than implementing themselves. So, if one of the hobbyist project owner's key is compromised or hand over their orphan project to somebody malicious to manage their npm, then they are screwed. Although same could apply to other language which have package management, npm is the worst among those. Do they ensure the dependencies are signed before building the binary? And always use the last known good version for building new binary? I really doubt.
Might as well link directly to the source: https://pastebin.com/jCDFcESz which really I think should be the article URL anyway (the tweet just links here too). Very interesting find!
