News for hackers. Stuff that matters.

A comment on Snyk security researcher deploys malicious NPM packages targeting Cursor.com. Parent comment

Re:Snyk security researcher deploys malicious NPM packages t... by jbreckmckye on Tuesday January 14, 2025 @01:14PM (#42701357)
Do you mean https://www.npmjs.com/package/carousel-react? By the looks of it, this was published by someone 7 years ago as part of a personal project. Nothing uses it.

Going through that list... they all look like personal projects, with no dependents, and a single release by a single person.

[ Parent | on HN ]
Re:Snyk security researcher deploys malicious NPM packages t... by chamomeal on Tuesday January 14, 2025 @01:48PM (#42701899)
Ok now that I’ve actually looked at the package.json, it seems like this must be a joke or something. It’s got packages for CLI arg parsing, math expression evaluation, hashing, etc.

When I’m back on my computer I may look at the source and confirm my suspicion that none of those are required for the carousel functionality lol

[ Parent | on HN ]