News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by cxr on Tuesday September 16, 2025 @08:57AM (#45261601)
If NPM really cared, they'd stop recommending people use their poorly designed version control system that relies on late-fetching third-party components required by the build step, and they'd advise people to pick a reliable and robust VCS like Git for tracking/storing/retrieving source code objects and stick to that. This will never happen.

NPM has also been sending out nag emails for the last 2+ years about 2FA. If anything, that constituted an assist in the attack on the Junon account that we saw a couple weeks ago.

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by ptx on Tuesday September 16, 2025 @09:18AM (#45261851)
NPM lock files seem to include hashes for integrity checking, so as long as you check the lock file into the VCS, what's the difference?
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by cxr on Tuesday September 16, 2025 @09:32AM (#45262037)
Wrong question; NPM isn't bedrock. The question to be answered if there is no difference is, "In that case, why bother with NPM?"
[ Parent | on HN ]