News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by johnisgood on Wednesday September 17, 2025 @11:35AM (#45277112)
> I would actually say ripgrep is not especially typical here. I put a lot of energy into keeping my dependency tree slim. Many Rust applications have hundreds of dependencies.

Thank you for your honesty, and like you and I said, you put a lot of energy into keeping the dependency tree slim. This is not as common as one would like to believe.

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by burntsushi on Wednesday September 17, 2025 @11:54AM (#45277366)
I agree it's not common. But neither are Rust applications with 1000+ dependencies. I don't think I've ever compiled a Rust project with over 1,000 dependencies.

Hundreds? Yes, absolutely. That's common.

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by johnisgood on Wednesday September 17, 2025 @12:11PM (#45277672)
Maybe I am just unlucky enough to always running into Rust projects that pull in over 1000 dependencies. :D

In retrospect, I should have kept a list of these projects. I probably have not deleted these directories though, so I probably still could make a list of some of these projects.

[ Parent | on HN ]