News for hackers. Stuff that matters.

A comment on NPM flooded with malicious packages downloaded more than 86,000 times. Parent comment

Re:NPM flooded with malicious packages downloaded more than ... by Havoc on Friday October 31, 2025 @09:17AM (#45771663)
The entire Front end dev seems like trust me bro Wild West to me. All feels like endless layers of duct tape. Which I guess in a way it is given the evolution of browsers
[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by augusto-moura on Friday October 31, 2025 @10:13AM (#45772192)
This is true for every moser package manager out there: pip, cargo, gradle and the lot. It is not about front end dev
[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by nightski on Friday October 31, 2025 @11:54AM (#45773492)
I've seen gnarly code everywhere, from kernel drivers to desktop applications to web apps. At the end of the day this describes most of computing imho.
[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by graemep on Friday October 31, 2025 @10:06AM (#45772127)
it seems a lot worse with NPM for some reason, but the underlying weaknesses apply to language package managers in general too.
[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by johnisgood on Friday October 31, 2025 @10:45AM (#45772531)
I think it is worse with npm because there are more people using it and more people know about it.

Lowering the barrier to entry is not paying off, for sure.

[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by quails8mydog on Saturday November 01, 2025 @05:32AM (#45780369)
I think part of the reason is the embrace of an "each package should do exactly one thing" by many in the community, often taken to a ridiculous extreme. Possibly better now after left-pad and other similar incidents.
[ Parent | on HN ]