Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by chamomeal on Tuesday September 16, 2025 @11:01AM (#45263264)

When I was learning JS/node/npm as a total programming newbie, a lot of the advice online was basically “if you write your own version of foobar when foobar is already available as an npm package, you’re stupid for wasting your time”.

I’d never worked in any other ecosystem, and I wish I realized that advice was specific to JS culture

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by jlarocco on Tuesday September 16, 2025 @11:53AM (#45263944)

It's not really bad advice, it just has different implications in Javascript.

In other languages, you'd have a few dependencies on larger libraries providing related functionality, where the Javascript culture is to use a bunch of tiny libraries to give the same functionality.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by lenerdenator on Tuesday September 16, 2025 @12:03PM (#45264086)

Sometimes I wonder how many of these tiny libraries are just the result of an attempt to have something ready for a conference talk and no one had the courage to say "Uh, Chris, that already exists, and the world doesn't need your different approach on it."

[ Parent | on HN ]