Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by silverwind on Tuesday September 16, 2025 @12:05PM (#45264113)

So, who is going to audit the thousands of new packages/versions that are published to npm every day? It only works for Debian because they hand-pick popular software.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by jonhohle on Tuesday September 16, 2025 @01:52PM (#45265494)

Maybe NPM should hand pick popular packages and we should get away from this idea of every platform should always let everyone publish. Curation is expensive, but it may be worthwhile for mature platforms.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by whizzter on Tuesday September 16, 2025 @03:12PM (#45266572)

This is maybe where we could start getting into money into the opensource ecosystems.

One idea I've had is that publishing is open as today, but security firms could offer audit signatures.

So a company might pay security firms and only accept updates to packages that have been audited by by 1,2,3 or more of their paid services.

Thus money would be paid in the open to have eyes on changes for popular packages and avoid the problem of that weird lone maintainer in northern Finland being attacked by the Chinese state.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by dvh on Tuesday September 16, 2025 @05:27PM (#45268310)

Errr, you! If you brought the dependency, it is now your job to maintain it and diff every update for backdoor.

[ Parent | on HN ]