Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by dboreham on Tuesday September 16, 2025 @04:11PM (#45267342)

Not updating is the other side of the same problem: library owners feel it is ok to make frequent backwards-compatibility breaking changes, often ignoring semver conventions. So consumers of their libraries are left with the choice to pin old insecure versions or spend time rewriting their code (and often transitive dependency code too) to keep up.

This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by banku_brougham on Tuesday September 16, 2025 @04:33PM (#45267611)

>This is what happens when nobody pays for anything and nobody feels they have a duty to do good work for free.

Weirdly, some of the worst CVE I can think of were with enterprize software.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by zelphirkalt on Tuesday September 16, 2025 @04:58PM (#45267964)

That's because there many people don't feel like it is their duty to do good work, even though they are paid ...

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by jand on Wednesday September 17, 2025 @04:34AM (#45273322)

Who do you mean with "many people"? Developers who do not care or middle management that oversold features and overcommitted w.r.t. deadlines? Or both? Someone else?

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by zelphirkalt on Wednesday September 17, 2025 @06:35AM (#45274069)

I was thinking of many developers, but actually middle management should be included.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by cutemonster on Thursday September 18, 2025 @08:14PM (#45296553)

And the CEO. And lawmakers

[ Parent | on HN ]