Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by WesolyKubeczek on Tuesday September 16, 2025 @05:10PM (#45268097)

"Find large numbers of trustworthy dependency authors in your neighborhood!"

"Large numbers of trustworthy dependency authors in your town can't wait to show you their hottest code paths! Click here for educational livecoding sessions!"

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by rectang on Tuesday September 16, 2025 @07:54PM (#45269857)

I don't understand your critique.

Establishing a false identity well enough to fool a FOSS author or organization is a lot of work. Even crafting a spear phishing email/text campaign doesn't compare to the effort you'd have to put in to fool a developer well enough to get offered publishing privileges.

Of course it's possible, but so are beat-them-with-a-five-dollar-wrench attacks.

[ Parent | on HN ]