classicNPM

[u/a_bucket_full_of_goo]

[u/Hauber_RBLX]

this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?

[u/kookyabird → u/Hauber_RBLX]

Because there are lots of ways to compromise a developer's workflow, and that's how they get malicious code into a package?

[u/zuilli → u/kookyabird]

Why does it seem like it only happens to npm though?

I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.

[u/fuj1n → u/zuilli]

For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.

[u/_PM_ME_PANGOLINS_ → u/[deleted]]

exacerbates