News for hackers. Stuff that matters.

A comment on NPM flooded with malicious packages downloaded more than 86,000 times. Parent comment

Re:NPM flooded with malicious packages downloaded more than ... by graemep on Friday October 31, 2025 @10:06AM (#45772127)
it seems a lot worse with NPM for some reason, but the underlying weaknesses apply to language package managers in general too.
[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by johnisgood on Friday October 31, 2025 @10:45AM (#45772531)
I think it is worse with npm because there are more people using it and more people know about it.

Lowering the barrier to entry is not paying off, for sure.

[ Parent | on HN ]
Re:NPM flooded with malicious packages downloaded more than ... by quails8mydog on Saturday November 01, 2025 @05:32AM (#45780369)
I think part of the reason is the embrace of an "each package should do exactly one thing" by many in the community, often taken to a ridiculous extreme. Possibly better now after left-pad and other similar incidents.
[ Parent | on HN ]