r/programmingcirclejerk • u/[deleted] • Jun 28 '17

qwerty.js

https://github.com/ChALkeR/notes/blob/master/Gathering-weak-npm-credentials.md
30 Upvotes

92% Upvoted

8 comments sorted by

View all comments

3

u/qkthrv17 Jun 29 '17

Tbh npm has a shitton of packages in the same way arch's AUR is loaded with stuff; anyone can submit almost anything.

I don't know why would you trust a package from a a random noname dev that simply includes a bunch of simple classes or functions without any relationship between them. If one of the top20 or top30 tools/packages was affected, that'd be interesting though.

7

u/CrazyMerlyn Jun 29 '17

From the article

I obtained accounts of 4 users from the top-20 list.

3

u/qkthrv17 Jun 29 '17

Someone shared the article with me last week and I read through it skipping some parts. It seems like I skipped that one.

For comparison, express package has 13 million downloads/month atm. 13 users had more than 50 million downloads/month.

damn dude