Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

41–50 of 325 posts

Re: 50% of new NPM packages are spam

#41

Post by prepend »

Ciantic wrote: post #26
sirius87 wrote: post #16

Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd

If the spammers only want to be indexed, then NPM should disable indexing for major search engines. But still allow it to be indexed other ways, which aren't unearthed on Google search. Other ideas include: do not index new packages before they've garnered enough downloads.

As a developer, I want npm package information and docs to show up in search. I frequently prefer pypi or cran results over others because then I can easily tell if it’s a usable package vs just some snippet.

Especially cran because it has pretty rigorous entry requirements so being in cran is a signal of at least some minimal quality.

Re: 50% of new NPM packages are spam

#42

Post by traveler01 »

Raed667 wrote: post #25
duxup wrote: post #19

Earlier quoted context omitted.

Are people who submit to NPM really that short on cash? I doubt it.

A lot of counties (like mine) don't have access to global payments. Having a card in Euro or USD requires special paperwork.

From my experience cryptocurrencies are helping countries overcome that. But still, money wouldn't be a solution for this issue.

Re: 50% of new NPM packages are spam

#43

Post by ricardobeat »

hollowturtle wrote: post #11

I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?

Deno’s model where code needs explicit permissions to use the network and file system is a good first step.

Re: 50% of new NPM packages are spam

#44

Post by counttheforks »

leshenka wrote: post #30
Ciantic wrote: post #26

Earlier quoted context omitted.

If the spammers only want to be indexed, then NPM should disable indexing for major search engines. But still allow it to be indexed other ways, which aren't unearthed on Google search. Other ideas include: do not index new packages before they've garnered enough downloads.

how do you garner enough downloads without being discoverable by Google?

Not npmjs.org's problem. Most languages their dependency managers don't give away indexed flashy web pages for free either, yet discoverability is usually not a problem.

Re: 50% of new NPM packages are spam

#45

Post by counttheforks »

ricardobeat wrote: post #43
hollowturtle wrote: post #11

I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?

Deno’s model where code needs explicit permissions to use the network and file system is a good first step.

That works per application process, not per dependency. So that's useless to guard against evil dependencies.

Re: 50% of new NPM packages are spam

#47

Post by dr-detroit »

counttheforks wrote: post #45
ricardobeat wrote: post #43

Earlier quoted context omitted.

Deno’s model where code needs explicit permissions to use the network and file system is a good first step.

That works per application process, not per dependency. So that's useless to guard against evil dependencies.

[dead]

Re: 50% of new NPM packages are spam

#48

Post by can16358p »

pipo234 wrote: post #7
miohtama wrote: post #2

Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission

> - Cross-Internet reputation system for accounts Gets rid of anonymous spam. > - Small fee on submission Gets rid of amateur spam. I guess that's 98% of the problem. I think this is a good start. What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?

Perhaps an optional small fee to be reviewed and "cleared" by a human reviewer (akin a blue checkmark) might be the nice middle ground (while you can still submit for free, but without an actual human clearing you "safe"). Of course it has its own problems like what happens an update is pushed, or something malicious in dependency tree and blue checkmark giving a false sense of security etc.

Re: 50% of new NPM packages are spam

#49

Post by lelanthran »

sokoloff wrote: post #38
wongarsu wrote: post #28

Earlier quoted context omitted.

One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…

I would find amusement if the solution to the spamming of npm turns out to be a genuinely useful use case for blockchain.

> I would find amusement if the solution to the spamming of npm turns out to be a genuinely useful use case for blockchain.

I think you can implement a web-of-trust without a blockchain.

Re: 50% of new NPM packages are spam

#50

Post by mnw21cam »

justinclift wrote: post #20
pipo234 wrote: post #7

Earlier quoted context omitted.

> - Cross-Internet reputation system for accounts Gets rid of anonymous spam. > - Small fee on submission Gets rid of amateur spam. I guess that's 98% of the problem. I think this is a good start. What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?

> What to do about bogus projects sponsored by wealthy companies? Does this happen in the real world, rather than as a theoretical concern? As a thought, when a problem is pressing then sometimes it's best to start with a reasonable action then course correct over time. Rather than doing nothing waiting for a perfect solution.

> Does this happen in the real world, rather than be a theoretical concern?

Heck yes. 99% of the stuff advertised to me in big money advertising campaigns is stuff that I will never want. If that doesn't count as "bogus projects sponsored by wealthy companies" then I don't know what does.

Post reply on HN