Re:50% of new NPM packages are spam
by loic-sharma on Thursday March 30, 2023 @08:38AM
(#35371707)
Google search is an extremely common way to discover packages. Disabling indexing entirely isn’t a valid solution.
Downloads are very easy to fake. Usually package managers don’t allow indexing until the package and its author reach a certain age. This allows the team to discover and remove the package before it is indexed.
Downloads are very easy to fake. Usually package managers don’t allow indexing until the package and its author reach a certain age. This allows the team to discover and remove the package before it is indexed.