Embedded malware in RC (NPM package)

Re:Embedded malware in RC (NPM package) by armchairhacker on Friday November 05, 2021 @11:23PM (#29127229)

Genuinely curious: why is malware always discovered in npm packages, and not pip (python), gradle/maven (JVM), cabal (Haskell), cargo (Rust), CRAN (R), etc.? Or are there major vulnerable packages in those repos but they just don't get audited?

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by Angius on Saturday November 06, 2021 @04:10AM (#29128327)

It's an attractive target. Other ecosystems (maybe besides Rust) rely on large packages with minimal dependencies, and those packages are often first-party (Entity Framework, for example).

NPM meanwhile is a neverending net of tiny oneliner packages, required by other oneliner packages, required by twoliner packages, required by single-function packages, required by... required by React. And thus, adding malware to `is-number` adds it to all 8766235452 packages that depend on it.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by swiley on Saturday November 06, 2021 @12:27AM (#29127527)

I thought someone happened in pip the other year.

Part of the NPM issue is that everything gets atomized into tiny libraries and no one seems to care about the dependency explosion.

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by tommek4077 on Saturday November 06, 2021 @05:17AM (#29128690)

The older such a system is, the more there is a "don't trust anyone" mentality. Some decades in the past you did not just run alien code in your system.

Edit: without looking at it beforehand

[ Parent | on HN ]

Re:Embedded malware in RC (NPM package) by schleck8 on Saturday November 06, 2021 @06:37AM (#29129088)

There definitely is malware around on PyPI, and typosquatting.

[ Parent | on HN ]