50% of new NPM packages are spam

Re:50% of new NPM packages are spam by chatmasta on Thursday March 30, 2023 @08:49AM (#35371828)

> if the NPM package wasn't in the results but its Github repo or homepage was you're still getting the results you wanted

Or you're getting a GitHub page with a similar name, or worse, a malicious GitHub page that instructs you to download the npm package you're looking for from a typo squatted version of it.

[ Parent | on HN ]

Re:50% of new NPM packages are spam by hombre_fatal on Thursday March 30, 2023 @05:04PM (#35378812)

Also NPM is the only source that can show you the code you're actually going to get whether you download and inspect the tarball or you use NPM's built-in code explorer.

A github page really isn't what I want at all when asking questions about an npm package except for the fact that I'm used to its code browser, so I tend to click it out of habit.

[ Parent | on HN ]