News for hackers. Stuff that matters.

A comment on NPM Vulnerability Discussion on Twitter. Parent comment

Re:NPM Vulnerability Discussion on Twitter by bostik on Tuesday May 10, 2022 @12:41PM (#31329194)
> Having 1000 NPM packages is better for your reputation than having 100. And having all 1000 packages with lots of weekly downloads is better than having just a portion of that.

Should we treat them as spammers and polluters, then? Because if what you describe is true, that deserves to be called out and mowed to the ground.

[ Parent | on HN ]
Re:NPM Vulnerability Discussion on Twitter by ratww on Tuesday May 10, 2022 @02:10PM (#31330391)
Definitely.

It is more akin to SEO spamming than black market spamming, though. They're polluting NPM in the same way SEO farms spam Google. It makes life difficult for everyone, but it's still a gray area in terms of legitimacy. Which is why nobody really talks about it.

[ Parent | on HN ]
Re:NPM Vulnerability Discussion on Twitter by sdoering on Tuesday May 10, 2022 @01:22PM (#31329711)
I don't know if this is true, but if it were true you'd have a veritable "tragedy of the commons" [0] situation were privatization of (some) gains leads to the creation of negative externalities for the rest.

If incentives were aligned differently, different results might have resulted. Probably with different externalities (or unintended consequences).

[0]: https://en.wikipedia.org/wiki/Tragedy_of_the_commons?wprov=s...

[ Parent | on HN ]