News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by jddj on Tuesday September 16, 2025 @08:08AM (#45261140)
Is the difference between the number of dev dependencies for eg. VueJs (a JavaScript library for marshalling Json Ajax responses into UI) and Htmx (the JavaScript library for marshalling html Ajax responses into UI) meaningful?

There is a difference, but it's not an order of magnitude and neither is a true island.

Granted, deciding not to use JS on the server is reasonable in the context of this article, but for the client htmx is as much a js lib with (dev) dependencies as any other.

https://github.com/bigskysoftware/htmx/blob/master/package.j...

https://github.com/vuejs/core/blob/main/package.json

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by yawaramin on Tuesday September 16, 2025 @11:28PM (#45271294)
Except that htmx's recommended usage is as a single <script> injected directly into your HTML page, not as an npm dependency. So unless you are an htmx contributor you are not going to be installing the dev dependencies.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by jddj on Saturday September 20, 2025 @05:39AM (#45311821)
That script still gets built somewhere using those deps
[ Parent | on HN ]