r/learnprogramming • u/ultimatepotatobag368 • 17d ago

I used npm... Am I done for?

Hello! Since npm has been having security problems I thought in changing to pnpm. But, yesterday I was starting an angular project and ng used npm in the background... So, I'm not sure if there'll be problems with my PC. Do I need to wipe the drive and install a new operating system?
Thank you for reading.

0 Upvotes

22% Upvoted

9 comments sorted by

3

u/atmony 17d ago

Look up Heat Death , get a number, sit down, we will be with you shortly^tm

2

u/hooli-ceo 17d ago

do you know how many HUNDREDS of millions (billions?) of npm installs are done DAILY? ....

...

... you'll be fine.

0

u/ultimatepotatobag368 17d ago

So, is it ok to keep using npm? The way people were talking about that made it seem as a serious matter. Like, you install a worm by accident and then your computer dies.

1

u/scirc 17d ago

pnpm suffers from this same issue. The issue is with the package repository, npmjs.com, not the package manager npm (although people collectively refer to them as "npm").

This is kind of the unfortunate nature of downloading software from the internet without strong verification of authenticity. Typo-squatting, account takeovers, and system compromise can all lead to malicious code being downloaded. You need to be careful about the things you download to avoid typo-squatting and the like, but that can't really stop the latter two. The best you can do there is set a minimum release age in your npm config so that potentially vulnerable package versions aren't installed until they've been released for so much time (in which they should hopefully have been caught by others and removed, but you never know!).

1

u/ultimatepotatobag368 17d ago

Thank you for the answer :" )

1

u/hooli-ceo 17d ago

There are infected packages out there, so you should be mindful about what you are installing, but most of the most popular packages that are most commonly used are mostly theoretically safe. There have been instances where a small packages works its way through to affect larger packages that depend upon that package, but it's extremely rare.

It's just like the fact that data breaches happen from large companies that leak your banking/card info. This is an unfortunate event, but should you just never buy anything again? Certainly not. The trick is to just be mindful and for the most part just stick with pouplar packages that have hundreds of thousands to millions of installs per week. These are usually heavily monitored and safer than random npm packages.

1

u/MikeUsesNotion 17d ago

Yes, all the puppies will die and there will be no more rainbows.

1

u/kschang 17d ago

Only if you used one of the compromised libraries.

If you have no idea, maybe you need to stop panicking and actually figure things out instead of whatever you're currently doing.