50% of new NPM packages are spam
blog.sandworm.dev
50% of new NPM packages are spam
1–10 of 325 posts
Re: 50% of new NPM packages are spam
#2Spam problems can be solved by
- Cross-Internet reputation system for accounts
- Small fee on submission
Re: 50% of new NPM packages are spam
#3> 50% of new NPM packages are spam
So all an attacker has to do is to publish an npm package. Wait, this alteady happened.
Re: 50% of new NPM packages are spam
#4Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
NPM for companies costs enough that it surely covers all the reviews already.
Re: 50% of new NPM packages are spam
#5Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
I don’t see anybody paying to submit a package to a registry. Even if NPM didn’t support other registries or direct installs from a versioning system, different tools would have been created by the community.
Re: 50% of new NPM packages are spam
#6Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
Small fee to submit open-source packages?
Re: 50% of new NPM packages are spam
#7Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
> - Cross-Internet reputation system for accounts
Gets rid of anonymous spam.
> - Small fee on submission
Gets rid of amateur spam.
I guess that's 98% of the problem. I think this is a good start.
What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?
Re: 50% of new NPM packages are spam
#8Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
> Small fee on submission
This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.
Re: 50% of new NPM packages are spam
#9So what happens when the spam is detected? Are the packages removed?