Re:Malicious code in the purescript NPM installer
by iamleppert on Sunday July 28, 2019 @08:59PM
(#20550725)
The problem is clearly due to vanity metrics like number of packages motivating people to publish an insane number of useless packages to fluff their contributions.
[ Parent
| on HN ]
Re:Malicious code in the purescript NPM installer
by ivanfon on Tuesday July 30, 2019 @12:32AM
(#20562157)
Agreed - I’ve found and been astonished by Github users who maintain hundreds of these little npm packages, all of which have usually under 10 lines of actual code, and sometimes even have chains of dependencies on the user’s other packages.
It seems like the only reason these packages get any significant downloads is when one of them gets depended on by a big package, causing the entire dependency chain of the user’s little packages to be downloaded.