Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by whstl on Tuesday September 16, 2025 @05:49PM (#45268596)

This is incredible.

At this rate, there's a non-zero chance that one of the transitive dependencies is SQLite itself.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by wolvesechoes on Wednesday September 17, 2025 @03:42AM (#45272993)

But it will be safe SQlite, called from Rust.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Meneth on Wednesday September 17, 2025 @09:05AM (#45275371)

3 different types of sqlite, 14 different versions total: https://github.com/tursodatabase/turso/network/dependencies?...

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by aw1621107 on Wednesday September 17, 2025 @01:01PM (#45278442)

Looks like they're all pulled in as dev dependencies. libsqlite3-sys gets pulled in by rusqlite, which is used by core_tester, limbo_sim, write-throughput-sqlite, and as a dev_dependency for turso_core.

[ Parent | on HN ]