News for hackers. Stuff that matters.

A comment on Fake VS Code Extension on NPM Spreads Multi-Stage Malware. Parent comment

Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by twelve40 on Monday February 10, 2025 @04:11PM (#43005199)
how um is this different from pypi or public repos in other languages... you could try to publish junk anywhere
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by recursive on Monday February 10, 2025 @04:21PM (#43005312)
In node projects, having more dependencies is usually seen as an asset, not a liability.

Other than that, I don't think there's a difference. When I write node projects, I tend to minimize dependencies, but I've seen PR comments saying "you know you could just get a package to do that".

[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by girvo on Monday February 10, 2025 @06:08PM (#43006464)
> In node projects, having more dependencies is usually seen as an asset, not a liability

Not in anywhere I've worked for the past ~decade...

[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by recursive on Monday February 10, 2025 @06:34PM (#43006708)
Replies seem to be indicating my experience is the outlier. That's reassuring to me.
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by girvo on Monday February 10, 2025 @07:30PM (#43007287)
It was definitely the case prior, though, so you're not completely off base :)
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by cluckindan on Monday February 10, 2025 @04:25PM (#43005363)
”Usually”?

Do you have some statistics on that, or do you just feel that way?

[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by recursive on Monday February 10, 2025 @04:30PM (#43005423)
Just feel that way. That's my anecdotal observation. YMMV.
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by wswope on Monday February 10, 2025 @05:19PM (#43006040)
[Misread, mb - ty @Jarwain]
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by Jarwain on Monday February 10, 2025 @05:31PM (#43006141)
You may have mixed up who the commenter was replying to. They were specifically questioning "usually seen as an asset not a liability" bit
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by bolognafairy on Monday February 10, 2025 @06:11PM (#43006495)
That’s really all there is in the comment. They’re unambiguously conflating “number of dependencies are higher” with some sort of statement about the value system of people that work with a certain language. It’s silly language tribalism.
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by Fauntleroy on Monday February 10, 2025 @05:49PM (#43006306)
This is an extremely weird thing to say. I don't know a single node dev who wants more dependencies. Anyone with a modicum of experience in the space knows the cost of bringing in more external code.
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by wswope on Monday February 10, 2025 @05:11PM (#43005952)
The lack of a batteries-included stdlib makes the JS ecosystem exceptionally vulnerable. PyPI is vulnerable to the same class of problems, but it’s an order of magnitude harder to execute a wide-reaching supply chain attack compared to NPM, since the dependency trees are far shorter on average.
[ Parent | on HN ]
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by bdhcuidbebe on Monday February 10, 2025 @07:13PM (#43007126)
With tensorflow and more recently local llm:s, running say ollama pulls in a scary amount of precompiled binaries from god knows where.

Just mentioning these because they are trendy.

Regarding the general issue, it can happen in any language with package management.

Its not reasonable to just yell js sucks because I’ve seen it in bunch of places by now.

[ Parent | on HN ]