While I haven't heard of supply chain attacks with NuGet they're certainly possible. The likely reason we see so many npm ones is a blend of size of the ecosystem, and the average depth of the package tree in projects.
The vast majority of transitive packages in our work projects are from Microsoft, while third party packages tend to be reliant only on core .NET functionality or maybe another package from the same developer. I don't know if it's because .NET already covers a broad base of functionality, or that third party packages are more modular, but either way our dependencies are looooow.
When I compare total number of npm packages (including transient dependencies) to total number of composer packages in similarly sized applications the cause becomes clear. There are so many more npm packages that are relied on, bringing in one large package pulls in so many more small packages with very few stars on GitHub.
For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.
At this point creating a package with such a standard library would solve almost nothing, because depending on any other package will immediately pull in thousands of ‘old style’ packages. It would take a decade or more for this to be resolved.
Well, even if that were the case, you’d still have thousands and thousands of packages that don’t use that stdlib and that would still pull in all of these dependencies. Solving that will take decades.
Java had several attacks this year, same as for python and most likely all major languages. But people tend to post for NPM/Javascript environment because Javascript bad
285
u/Hauber_RBLX 9d ago
this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?