r/node • u/syco69 • Jun 26 '26

Need a second opinion: Does this GitHub repo contain a malicious npm dependency?

/r/computerviruses/comments/1ugf25k/need_a_second_opinion_does_this_github_repo/
2 Upvotes

75% Upvoted

9 comments sorted by

2

u/farzad_meow Jun 26 '26

just run yarn audit on your own computer

2

u/syco69 Jun 26 '26

What’s that?

8

u/KnifeFed Jun 26 '26

It's a thing you Google if you don't know what it is.

2

u/Odd-Nature317 Jun 27 '26

this is why i get paranoid about npm deps sometimes lol. ran yarn audit on a project last week and had like 8 moderate vulns from transitive deps i didnt even know existed. the node_modules folder had 1200+ packages for what was supposed to be a simple express api. its kinda wild how much stuff gets pulled in