Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by lucideer on Tuesday September 16, 2025 @03:34PM (#45266860)

I'm not a Java (nor Kotlin) developer - I've only done a little Java project maintenance & even less Kotlin - I've mainly come at this as a tooling developer for dependency management & vulnerability remediation. But I have seen a LOT of varied maven-managed repos in that line of work (100s) and the approaches are wide - varied.

I know this is possible with custom plugins but I've mainly just seen it using maven wrapper & user properties.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yeroc on Tuesday September 16, 2025 @04:32PM (#45267584)

There are things that are potentially possible such as templating pom.xml build files or adjusting dependencies based on user properties (this that what you're suggesting?), but what you're describing is definitely not normal, or best practice in the ecosystem and shouldn't be presented as if it's normal practice.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by lucideer on Tuesday September 16, 2025 @06:12PM (#45268891)

Attackers don't need these practices to be normal, they just need them to be common enough (significant minority of)

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yeroc on Tuesday September 16, 2025 @11:04PM (#45271145)

You're talking about things that aren't in the significant minority here.

[ Parent | on HN ]