News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by ronsor on Tuesday September 16, 2025 @12:31PM (#45264470)
Because then it's extra hassle and expense for new developers to publish a package, and we're trying to keep things decentralized.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by kelnos on Tuesday September 16, 2025 @03:39PM (#45266931)
Decentralized? This is a centralized package registry. There is nothing decentralized about it.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by jay_kyburz on Tuesday September 16, 2025 @05:34PM (#45268419)
oh right, good point, I wonder when somebody will just sue NPM for any damage caused. That's really the only way we'll see change I think.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by thewebguyd on Tuesday September 16, 2025 @02:07PM (#45265686)
It's already centralized by virtue of using and relying on NPM as the registry.

If we want decentralized package management for node/javascript, you need to dump NPM - why not something like Go's system which is actually decentralized? There is no package repository/registry, it's all location based imports.

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by LPisGood on Tuesday September 16, 2025 @02:51PM (#45266277)
I don’t understand what benefits this kind of “decentralization” offers
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by q3k on Tuesday September 16, 2025 @03:49PM (#45267064)
Larger pool of people you can hack/blackmail/coerce into giving you access to millions of systems :)
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by LtWorf on Tuesday September 16, 2025 @04:34PM (#45267621)
Download counters are completely useless. I could download your package 2 million times in under a minute and cause you to need the 2FA.

And true 2FA means you can't automate publishing from github's CI. Python is going the other direction. There is a fake 2FA that is just used to generate tokens and there is a preferential channel to upload to pypi via github's CI.

But in my opinion none of this helps with security. But it does help to de-anonymise the developers, which is probably what they really want to do, without caring if those developers get hacked and someone else uses their identity to do uploads.

[ Parent | on HN ]