Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by skydhash on Tuesday September 16, 2025 @10:10AM (#45262486)

C library is smaller than Node.js (you won’t have HTTP). What C have is much more respectable libraries. If you add libcurl or freetype to your project, it won’t pull the whole jungle with them.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by int_19h on Tuesday September 16, 2025 @11:10AM (#45263387)

What C doesn't have is an agreed-upon standard package manager. Which means that any dependency - including transitive ones! - requires some effort on behalf of the developer to add to the build. And that, in turn, puts pressure on library authors to avoid dependencies other than a few well-established libraries (like libpng or GLib),

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by koakuma-chan on Tuesday September 16, 2025 @03:25PM (#45266734)

You can add curl to a Rust project too.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by aakkaakk on Tuesday September 16, 2025 @09:01PM (#45270294)

But why, when reqwest is enough for 99% of cases.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by koakuma-chan on Tuesday September 16, 2025 @09:45PM (#45270603)

It's bloated.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by WD-42 on Wednesday September 17, 2025 @12:42PM (#45278194)

It requires Tokio, and believe it or not there are actual cases for non-async rust. So you can't use it in that case.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by bigstrat2003 on Wednesday September 17, 2025 @05:11PM (#45281451)

Because it requires using async, and for most programs async is not worth the extra effort (plus very heavy dependency in the form of Tokio).

[ Parent | on HN ]