Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by rs999gti on Tuesday September 16, 2025 @10:36AM (#45262851)

> supply chain attacks

You all really need to stop using this term when it comes to OSS. Supply chain implies a relationship, none of these companies or developers have a relationship with the creators other than including their packages.

Call it something like "free code attacks" or "hobbyist code attacks."

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by shermantanktop on Tuesday September 16, 2025 @10:43AM (#45262967)

“code I picked up off the side of the road”

“code I somehow took a dependency on when copying bits of someone’s package.json file”

“code which showed up in my lock file and I still don’t know how it got there”

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by orbital-decay on Tuesday September 16, 2025 @10:48AM (#45263069)

All of which is true for far too many projects

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by pixl97 on Tuesday September 16, 2025 @10:55AM (#45263155)

A supply chain can have hobbyists, there's no particular definition that says everyone involved must be a professional registered business.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by __alexs on Tuesday September 16, 2025 @10:42AM (#45262948)

I know CrowdStrike have a pretty bad reputation but calling them hobbyists is a bit rude.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by cobbal on Tuesday September 16, 2025 @01:22PM (#45265117)

I'm sure no offense was intended to hobbyists, but it was indeed rude

[ Parent | on HN ]