Self Propagating NPM Malware Compromises over 40 Packages

Re:Self Propagating NPM Malware Compromises over 40 Packages by ForHackernews on Thursday September 18, 2025 @04:45AM (#45287193)

k, let me know how your CI pipeline fares the next time there's a Github outage and we can revisit this discussion of Go's fantastic uniquely decentralized dependency management.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yasuraka on Friday September 19, 2025 @02:22AM (#45298498)

You really ought to research a topic before arguing.

For the average user, both GitHub and default $GOPROXY would have to be down. For me, my CI runs where my (and code I've cloned) lives, self-hosted GitLab.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by ForHackernews on Friday September 19, 2025 @10:43AM (#45302221)

Oh my god, you've figured out caching!? Will wonders never cease! Truly, Golang is the ecosystem of the future free from all centralized dependencies.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yasuraka on Sunday September 21, 2025 @03:16AM (#45320741)

I accept your concession.

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by ForHackernews on Sunday September 21, 2025 @02:47PM (#45325500)

Again, you're not special as you'd like to imagine: https://devpi.net/docs/devpi/devpi/latest/%2Bd/index.html

[ Parent | on HN ]

Re:Self Propagating NPM Malware Compromises over 40 Packages by Yasuraka on Tuesday September 23, 2025 @05:02AM (#45344542)

Again, you've missed the mark: a mirror doesn't make a system decentralized not turn a package repository into URIs for code.

[ Parent | on HN ]