Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

31–40 of 325 posts

Re: 50% of new NPM packages are spam

#31

Post by newswasboring »

ethicalsmacker wrote: post #29
newswasboring wrote: post #8

Earlier quoted context omitted.

> Small fee on submission This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.

If only there were some kind of decentralized digital currency a person could use outside of big banks and credit cards..

Dude I couldn't get a credit card in India, do you think a young person can easily get bitcoin? Its not that I was banned from getting it, its just that I couldn't afford it and getting it was really hard. Getting bitcoin, starting from fiat, is equally hard.

Re: 50% of new NPM packages are spam

#32

Post by wruza »

miohtama wrote: post #2

Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission

Captcha is an alternative to small fee, cause solving it automatically costs money.

Real fee will scare away almost all amateur developers and almost all professional developers who don’t already have a business account available.

Re: 50% of new NPM packages are spam

#33

Post by andreimarinescu »

supriyo-biswas wrote: post #23

Is this spam not easily mitigated by simple Bayesian approaches and collection of link features by visiting them?

That would probably work. Also not allowing fully anonymous accounts and linking publishers to real identities would also work in my mind.

Re: 50% of new NPM packages are spam

#34

Post by FredPret »

wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

So true. It's truly sad that some people can hold tight to their cynicism even as they build up their technical skills

Re: 50% of new NPM packages are spam

#36

Post by ehutch79 »

JosephRedfern wrote: post #21
ehutch79 wrote: post #13

Earlier quoted context omitted.

It’s not about revenue, it’s about making spam unprofitable. Charging 0.25$usd is enough to make spam not worth it. It also attaches an identity to the posting.

I think the suggestion was that the revenue generated by NPM's commercial dealings should cover any cost associated with a review process for OSS submissions (which in itself would make such spam repositories ineffective)

So, let the spam happen, and remove it after the fact using humans? Or hold all submissions until a human reviews it?

Re: 50% of new NPM packages are spam

#37

Post by Mayzie »

wongarsu wrote: post #28
hollowturtle wrote: post #11

I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?

One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…

Aand we’re back to PGP/GPG.

Re: 50% of new NPM packages are spam

#38

Post by sokoloff »

wongarsu wrote: post #28
hollowturtle wrote: post #11

I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?

One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…

I would find amusement if the solution to the spamming of npm turns out to be a genuinely useful use case for blockchain.

Re: 50% of new NPM packages are spam

#39

Post by Ciantic »

leshenka wrote: post #30
Ciantic wrote: post #26

Earlier quoted context omitted.

If the spammers only want to be indexed, then NPM should disable indexing for major search engines. But still allow it to be indexed other ways, which aren't unearthed on Google search. Other ideas include: do not index new packages before they've garnered enough downloads.

how do you garner enough downloads without being discoverable by Google?

It's a fair question, most JS libraries I've discovered weren't directly accessed with Google -> npmjs.com but instead from the library's own page, GitHub, Hacker News, etc.

If I Google a library and end up on npmjs.com I usually just click on a link to the library's repository or home page first.

Of course, it would disenfranchise a bit, but what is another option?

Post reply on HN