Re:NPM Vulnerability Discussion on Twitter
by mhitza on Tuesday May 10, 2022 @09:26AM
(#31326844)
At least at some point I've randomly stumbled over a GitHub account that had published many NPM packages with one-two function source code. They marketed themselves as a big contributor to the NPM ecosystem, which was directly based upon the number of NPM packages published and the number of monthly downloads. Some packages seemed to take off because people just do a npm install instead of replicating a one line function, while others I think were more popular nodejs projects of this user where they tried to force as many of their own dependencies as they could.
TL;DR "SEO" spam to market ones own nodejs expertise, would not be out of the question
TL;DR "SEO" spam to market ones own nodejs expertise, would not be out of the question