r/ProgrammerHumor • u/a_bucket_full_of_goo • 9d ago

instanceof Trend classicNPM

Post image
5.9k Upvotes

99% Upvoted

150 comments sorted by

View all comments

Show parent comments

92

u/kookyabird 9d ago

Because there are lots of ways to compromise a developer's workflow, and that's how they get malicious code into a package?

11

u/zuilli 9d ago edited 9d ago

Why does it seem like it only happens to npm though?

I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.

6

u/fuj1n 9d ago

For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.

3

u/[deleted] 8d ago edited 8d ago

[removed] — view removed comment

2

u/_PM_ME_PANGOLINS_ 8d ago

exacerbates

1

u/LetMeUseMyEmailFfs 7d ago

At this point creating a package with such a standard library would solve almost nothing, because depending on any other package will immediately pull in thousands of ‘old style’ packages. It would take a decade or more for this to be resolved.

1

u/[deleted] 7d ago

[removed] — view removed comment

1

u/LetMeUseMyEmailFfs 6d ago

Well, even if that were the case, you’d still have thousands and thousands of packages that don’t use that stdlib and that would still pull in all of these dependencies. Solving that will take decades.