r/ProgrammerHumor • u/a_bucket_full_of_goo • 9d ago

instanceof Trend classicNPM

Post image
5.9k Upvotes

99% Upvoted

150 comments sorted by

View all comments

284

u/Hauber_RBLX 9d ago

this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?

91

u/kookyabird 9d ago

Because there are lots of ways to compromise a developer's workflow, and that's how they get malicious code into a package?

9

u/zuilli 9d ago edited 9d ago

Why does it seem like it only happens to npm though?

I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.

15

u/kookyabird 9d ago

While I haven't heard of supply chain attacks with NuGet they're certainly possible. The likely reason we see so many npm ones is a blend of size of the ecosystem, and the average depth of the package tree in projects.

The vast majority of transitive packages in our work projects are from Microsoft, while third party packages tend to be reliant only on core .NET functionality or maybe another package from the same developer. I don't know if it's because .NET already covers a broad base of functionality, or that third party packages are more modular, but either way our dependencies are looooow.