News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by hombre_fatal on Tuesday September 16, 2025 @10:44AM (#45262978)
The problem with your idea is that you need to find the person who wants to do all this auditing of every version of Node/Python/Ruby libraries.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by carlhjerpe on Tuesday September 16, 2025 @11:28AM (#45263601)
I believe good centralized infrastructure for this would be a good start. It could be "gamified" and reviewers could earn reputation for reviewing packages, common packages would be reviewed all the time.

Kinda like Stackoverflow for reviews, with optional identification and such.

And honestly an LLM can strap a "probably good" badge on things with cheap batch inference.

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by pabs3 on Tuesday September 16, 2025 @10:17PM (#45270807)
Decentralised auditing is what is needed.

https://github.com/crev-dev/

[ Parent | on HN ]