News for hackers. Stuff that matters.

A comment on Detecting the use of “curl | bash” server side. Parent comment

Re:Detecting the use of “curl | bash” server side by pydry on Tuesday December 27, 2022 @07:23AM (#34148040)
I find that this is more of an npm problem - thanks to the lack of a standard library and a cultural affectation towards small packages with a narrow focus.

A high level python package is more likely to depend upon 3-30 well known packages.

[ Parent | on HN ]
Re:Detecting the use of “curl | bash” server side by danenania on Tuesday December 27, 2022 @08:23AM (#34148363)
I think the biggest factor is just a much larger overall number of packages in the ecosystem. If there are, on average, 20 popular packages for solving a given problem instead of 3, you end up with exponentially more transitive dependencies.
[ Parent | on HN ]