Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by spoiler on Tuesday September 16, 2025 @11:21AM (#45263514)

Not saying this in defence of Rust or Cargo, but often times those dependencies are just different versions of the same thing. In a project at one of my previous companies, a colleague noticed we had LOADS of `regex` crate versions. Forgot the number but it was well over 100

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by treyd on Tuesday September 16, 2025 @11:41AM (#45263778)

That seems like a failure in workspace management. The most duplicates I've seen was 3, with crates like url or uuid, even in projects with 1000+ distinct deps.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by burntsushi on Tuesday September 16, 2025 @06:34PM (#45269137)

That doesn't make sense. The most it could be is 3: regex 0.1.x, regex 0.2.y and regex 1.a.b. You can't have more because Cargo unifies on semver compatible versions and regex only has 3 semver incompatible releases. Plus, regex 1.0 has been out for eons. Pretty much everyone has moved off of 0.1 and 0.2.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by spoiler on Wednesday September 17, 2025 @06:58AM (#45274201)

The reason he went down this rabbit hole was because he was chronically running low on disk space, and his target dir was one of the largest contributors.

Not sure how he actually got the number; this was just a frustrated Slack message like 4 years ago

A sibling comment mentions we could have been using Cargo workspaces wrong... So, maybe?

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by burntsushi on Wednesday September 17, 2025 @08:39AM (#45275133)

He probably just needed to run `cargo clean` occasionally.

But you definitely aren't finding hundreds of versions of `regex` in the same dependency tree.

[ Parent | on HN ]