News for hackers. Stuff that matters.

A comment on NPM flooded with malicious packages downloaded more than 86,000 times. Parent comment

Re:NPM flooded with malicious packages downloaded more than ... by gear54rus on Friday October 31, 2025 @06:59AM (#45770640)
> entire npm setups inside docker containers

Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade?

Also both NPM and PNPM already freeze dependencies for you by default without any arcane docker setups.

[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by jwr on Friday October 31, 2025 @07:44AM (#45770950)
> Did you then spend a month or two inspecting that setup? Did you do that after every dependency upgrade?

TBH, I never updated some of the setups. What's the point? Their job was to generate a CSS. Why would I want to upgrade dependencies or inspect that setup?

> arcane docker setups

I take issue with "arcane" — I have much more "arcane" setups than these :-)

[ Parent | on HN ]