Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yeroc on Tuesday September 16, 2025 @04:32PM (#45267584)

There are things that are potentially possible such as templating pom.xml build files or adjusting dependencies based on user properties (this that what you're suggesting?), but what you're describing is definitely not normal, or best practice in the ecosystem and shouldn't be presented as if it's normal practice.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by lucideer on Tuesday September 16, 2025 @06:12PM (#45268891)

Attackers don't need these practices to be normal, they just need them to be common enough (significant minority of)

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yeroc on Tuesday September 16, 2025 @11:04PM (#45271145)

You're talking about things that aren't in the significant minority here.

[ Parent | on HN ]