Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yeroc on Tuesday September 16, 2025 @12:13PM (#45264222)

> Maven land is full of plugins with automated pom.xml version templating that has effectively the same effect as lax versioning, but without any strict adherence to any kind of standard like semver.

Please elaborate on this. I'm a long-time Java developer and have never once seen something akin to what you're describing here. Maven has support for version ranges but in practice it's very rarely used. I can expect a project to build with the exact same dependencies resolved today and in six months or a year from now.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by lucideer on Tuesday September 16, 2025 @03:34PM (#45266860)

I'm not a Java (nor Kotlin) developer - I've only done a little Java project maintenance & even less Kotlin - I've mainly come at this as a tooling developer for dependency management & vulnerability remediation. But I have seen a LOT of varied maven-managed repos in that line of work (100s) and the approaches are wide - varied.

I know this is possible with custom plugins but I've mainly just seen it using maven wrapper & user properties.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yeroc on Tuesday September 16, 2025 @04:32PM (#45267584)

There are things that are potentially possible such as templating pom.xml build files or adjusting dependencies based on user properties (this that what you're suggesting?), but what you're describing is definitely not normal, or best practice in the ecosystem and shouldn't be presented as if it's normal practice.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by lucideer on Tuesday September 16, 2025 @06:12PM (#45268891)

Attackers don't need these practices to be normal, they just need them to be common enough (significant minority of)

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yeroc on Tuesday September 16, 2025 @11:04PM (#45271145)

You're talking about things that aren't in the significant minority here.

[ Parent | on HN ]