Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by RUnconcerned on Tuesday September 16, 2025 @08:18AM (#45261237)

What other language ecosystems have had this happen systematically? This isn't even the first time this month!

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by blueflow on Tuesday September 16, 2025 @09:33AM (#45262049)

Python/PyPi.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by johnisgood on Tuesday September 16, 2025 @10:13AM (#45262513)

Rust.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by LPisGood on Tuesday September 16, 2025 @02:06PM (#45265664)

Go has this issue

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by SkyPuncher on Tuesday September 16, 2025 @04:55PM (#45267928)

NPM is the most popular, so it happens the most frequently. All of the other ecosystems are just as susceptible.

Unix had a big scare last year because of XZ Utils.

https://en.wikipedia.org/wiki/XZ_Utils_backdoor

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Sankozi on Wednesday September 17, 2025 @05:20AM (#45273588)

No they are not as susceptible - auto updating dependencies, post install scripts and culture of thousands of crappy micro packages (like left-pad) is mainly a NPM issue.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by zachrip on Wednesday September 17, 2025 @09:23AM (#45275554)

Packages are not auto updated if you have a package-lock. Agreed that post-install, left-pad, etc have been overall problematic tho.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by mdavidn on Tuesday September 16, 2025 @11:32PM (#45271328)

RubyGems is susceptible too.

[ Parent | on HN ]