Fake VS Code Extension on NPM Spreads Multi-Stage Malware

Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by wswope on Monday February 10, 2025 @05:11PM (#43005952)

The lack of a batteries-included stdlib makes the JS ecosystem exceptionally vulnerable. PyPI is vulnerable to the same class of problems, but it’s an order of magnitude harder to execute a wide-reaching supply chain attack compared to NPM, since the dependency trees are far shorter on average.

[ Parent | on HN ]

Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware by bdhcuidbebe on Monday February 10, 2025 @07:13PM (#43007126)

With tensorflow and more recently local llm:s, running say ollama pulls in a scary amount of precompiled binaries from god knows where.

Just mentioning these because they are trendy.

Regarding the general issue, it can happen in any language with package management.

Its not reasonable to just yell js sucks because I’ve seen it in bunch of places by now.

[ Parent | on HN ]