News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by weinzierl on Tuesday September 16, 2025 @08:59AM (#45261617)
In Rust we have cargo vet, where we share these audits and use them in an automated fashion. Companies like Google and Mozilla contribute their audits.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by quotemstr on Tuesday September 16, 2025 @09:23AM (#45261917)
And it's a great idea, similar thematically to certificate transparency
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by gedy on Tuesday September 16, 2025 @01:58PM (#45265570)
It's too bad MS doesn't own npm, and/or GitHub repositories. Wait
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by LikesPwsh on Tuesday September 16, 2025 @03:47PM (#45267047)
Nuget, Powershell gallery, the marketplaces for VSCode/VS/AZDo and the Microsoft Store too. Probably another twenty.

They collect package managers like funko pops.

I'm not quite sure about the goal. Maybe some more C# dev kit style rug-pulls where the ecosystem is nominally open-source but MS own the development and distribution so nobody would bother to compete.

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by lovich on Tuesday September 16, 2025 @04:57PM (#45267955)
I took those acquisitions and a few others like LinkedIn and all the visual studio versions as a sign that Microsoft is trying to own the software engineer career as a domain.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by pabs3 on Tuesday September 16, 2025 @10:15PM (#45270798)
I wish cargo went with crev instead, that has a much better model for distributed code audits.

https://github.com/crev-dev/

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by oneshtein on Wednesday September 17, 2025 @02:18AM (#45272382)
How to backport security fixes to vetted packages?
[ Parent | on HN ]