I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?
50% of new NPM packages are spam
11–20 of 325 posts
Re: 50% of new NPM packages are spam
#12Re: 50% of new NPM packages are spam
#13Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
NPM for companies costs enough that it surely covers all the reviews already.
It’s not about revenue, it’s about making spam unprofitable. Charging 0.25$usd is enough to make spam not worth it.
It also attaches an identity to the posting.
Re: 50% of new NPM packages are spam
#14> 50% of new NPM packages are spam So all an attacker has to do is to publish an npm package. Wait, this alteady happened.
To do what? You also need people to install said package.
Re: 50% of new NPM packages are spam
#15Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
The fee structure is the most interesting in my perspective. It would be interesting to see how an open source platform could combat this with a gas-fee structure using their own token economy. You'd need to get tokens to submit, which you can get by donations by engaging with a community, or by buying them, etc.
Re: 50% of new NPM packages are spam
#16Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO.
Re: 50% of new NPM packages are spam
#17Searching for the string "down_load_ebook" does unearth a lot of packages. https://www.npmjs.com/search?q=down_load_ebook
About 100k spam packages, with no false positives that I can see.
Re: 50% of new NPM packages are spam
#18So what happens when the spam is detected? Are the packages removed?
I've been monitoring NPMJS for a few months now. Up until Feb 28th they had a very close handle on these packages and removed them in around 8 hours. We're seeing these packages stay online for a lot longer now (and the volume is much higher)
Re: 50% of new NPM packages are spam
#19Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
> Small fee on submission This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.
Are people who submit to NPM really that short on cash?
I doubt it.
Re: 50% of new NPM packages are spam
#20Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
> - Cross-Internet reputation system for accounts Gets rid of anonymous spam. > - Small fee on submission Gets rid of amateur spam. I guess that's 98% of the problem. I think this is a good start. What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?
> What to do about bogus projects sponsored by wealthy companies?
Does this happen in the real world, rather than as a theoretical concern?
As a thought, when a problem is pressing then sometimes it's best to start with a reasonable action then course correct over time. Rather than doing nothing waiting for a perfect solution.