Re:Self Propagating NPM Malware Compromises over 40 Packages
by cesarb on Tuesday September 16, 2025 @06:04PM
(#45268783)
One famous example is ripgrep (https://github.com/BurntSushi/ripgrep). Its Cargo.lock (which contains all direct and indirect dependencies) lists 65 dependencies (it has 66 entries, but one of them is for itself).
[ Parent
| on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages
by burntsushi on Tuesday September 16, 2025 @06:32PM
(#45269118)
Also, that lock file includes development dependencies and dependencies for opt-in features like PCRE2. A normal `cargo build` will use quite a bit fewer than 65 dependencies.
I would actually say ripgrep is not especially typical here. I put a lot of energy into keeping my dependency tree slim. Many Rust applications have hundreds of dependencies.
We aren't quite at thousands of dependencies yet though.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by johnisgood on Wednesday September 17, 2025 @11:35AM
(#45277112)
> I would actually say ripgrep is not especially typical here. I put a lot of energy into keeping my dependency tree slim. Many Rust applications have hundreds of dependencies.
Thank you for your honesty, and like you and I said, you put a lot of energy into keeping the dependency tree slim. This is not as common as one would like to believe.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by burntsushi on Wednesday September 17, 2025 @11:54AM
(#45277366)
I agree it's not common. But neither are Rust applications with 1000+ dependencies. I don't think I've ever compiled a Rust project with over 1,000 dependencies.
Hundreds? Yes, absolutely. That's common.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by johnisgood on Wednesday September 17, 2025 @12:11PM
(#45277672)
Maybe I am just unlucky enough to always running into Rust projects that pull in over 1000 dependencies. :D
In retrospect, I should have kept a list of these projects. I probably have not deleted these directories though, so I probably still could make a list of some of these projects.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by johnisgood on Wednesday September 17, 2025 @11:31AM
(#45277060)
Not quite. He is a better developer than most who happen to minimize dependencies, but according to my experiences it is not as common as you would like to believe. Do I really need to make a list of all the Rust projects I have compiled that pulled in over 1000 dependencies? If I need to do it to convince you, I will do so, as my time allows.