News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by koakuma-chan on Tuesday September 16, 2025 @10:33AM (#45262797)
I think it's justified for Zed. It does a lot of things.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by rudedogg on Tuesday September 16, 2025 @12:17PM (#45264272)
Zed isn’t special, I doubt Sublime Text has thousands of dependencies. It’s a language/culture problem.

Edit: Ghostty is a good counter-example that is open source. https://github.com/ghostty-org/ghostty/tree/main/pkg

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by koakuma-chan on Tuesday September 16, 2025 @03:23PM (#45266706)
Zed is closer to IntelliJ or VSCode than to Sublime Text.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by biggusdickus69 on Tuesday September 16, 2025 @08:38PM (#45270137)
In the amount of bloat, yes.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by johnisgood on Wednesday September 17, 2025 @11:29AM (#45277037)
It is also important to note that this is not specific to Zed. As someone else have mentioned, it is a cultural problem. I picked Zed as an example because that is what I compiled the last time, but it is definitely not limited to Zed. There are many Rust projects that pull in over 1000 dependencies and they do much less than Zed.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by koakuma-chan on Wednesday September 17, 2025 @02:12PM (#45279323)
Yeah tbh one time I had a Rust job and their back-end had like 700-800 dependencies.
[ Parent | on HN ]