Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

101–110 of 325 posts

Re: 50% of new NPM packages are spam

#101

Post by FredPret »

criley2 wrote: post #63
FredPret wrote: post #34

Earlier quoted context omitted.

So true. It's truly sad that some people can hold tight to their cynicism even as they build up their technical skills

The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…

You're correct, though I think part of the reason there's more cybercrime from distant countries is the lack of consequences.

I will add that this mentality does not exactly build up their societies to fix the problem. When I moved from Africa to the first world, the high level of trust and conscientious behaviour by everybody blew my mind.

My point being that wholesome behaviour and net worth are linked in a virtuous cycle.

Re: 50% of new NPM packages are spam

#103

Post by input_sh »

duxup wrote: post #19
newswasboring wrote: post #8

Earlier quoted context omitted.

> Small fee on submission This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.

Are people who submit to NPM really that short on cash? I doubt it.

Having cash and having means to spend that cash online while living in a random country are two very different things.

It's easy to get a Visa/Mastercard in the US. It gets a bit trickier in some EU countries. Then the further from the west you go, the more complicated it gets, all the way down to impossible if you live in a place that the US isn't on friendly terms with (like Iran or Russia).

If you auto-assume everyone can pay any amount online (even if it's a refundable $1 for verification purposes), you're gonna cut off access to a lot of people unintentionally, while only raising the bar a little bit for spammers.

Re: 50% of new NPM packages are spam

#105

Post by chatmasta »

onion2k wrote: post #52
prepend wrote: post #41

Earlier quoted context omitted.

As a developer, I want npm package information and docs to show up in search. I frequently prefer pypi or cran results over others because then I can easily tell if it’s a usable package vs just some snippet. Especially cran because it has pretty rigorous entry requirements so being in cran is a signal of at least some minimal quality.

As a developer, I want npm package information and docs to show up in search. What case is there when you want to find a package in NPM, and information about that package, using Google? If you want information about the package then it's find if the NPM package page is missing from the results - so long as you're getting the package's homepage or git repo then that's plenty. From there you can get to it's NPM page.…

What? Nearly every time I search a package name in Google, I'm trying to get to the npm page. And I want to find the matching npm page so I can click from there to the associated GitHub, since it's the most trustworthy way to know I'm browsing the source of that specific package.

Re: 50% of new NPM packages are spam

#106

Post by pipo234 »

mindcandy wrote: post #72
mnw21cam wrote: post #50

Earlier quoted context omitted.

> Does this happen in the real world, rather than be a theoretical concern? Heck yes. 99% of the stuff advertised to me in big money advertising campaigns is stuff that I will never want. If that doesn't count as "bogus projects sponsored by wealthy companies" then I don't know what does.

In the real world, do wealthy companies want to be named on this list of 3 or 4 groups spamming NPM? That’s a lot different than being seen buying a banner ad.

That's probably where the reputation part would come in - fair enough. Still, a large wealthy company might consider creating an "unaffiliated" front company to act on their behalf. For example, take out a legit open source competitor by having the front publish a mediocre bogus project with very similar name. Or paying a small fee to bundle malware into a legit FOSS.

So, similar to Twitter's blue check mark - Yes, asking a "small fee" adds friction, but it's not an obstacle to the wealthy.

Re: 50% of new NPM packages are spam

#107

Post by overthrow »

sokoloff wrote: post #59
lelanthran wrote: post #49

Earlier quoted context omitted.

> I would find amusement if the solution to the spamming of npm turns out to be a genuinely useful use case for blockchain. I think you can implement a web-of-trust without a blockchain.

You can (because it's been done); this is a use case where "distributed but extremely slow database" is a pretty natural fit for the problem.

What advantages specifically would a blockchain have? Where does the existing solution, of using a fast database and trusting someone's private key, fall short?

Re: 50% of new NPM packages are spam

#108

Post by loic-sharma »

yklcs wrote: post #91

Since this is an npmjs problem, I wonder if a CAPTCHA requiring the uploader to solve a JS programming problem could work. Something hard for spammers to solve just by googling – writing a function, filling in blank code, etc. This would require the uploader to have at least basic (or intermediate, depending on the difficulty) knowledge in JS. Maybe the generated data could be used to fine tune LLMs.

Disallowing automated publishing would prevent CI/CD scenarios.

The spammers are creating large amounts of one-off accounts on external login providers like Microsoft Account. I’m sure those have some sort of CAPTCHA.

Re: 50% of new NPM packages are spam

#109

Post by chatmasta »

onion2k wrote: post #88
unbalancedevh wrote: post #78

Earlier quoted context omitted.

> there is no overlap in the Venn diagram of "searching for a package" and "searching for information about a package". I don't know, if I want information about something, it seems pretty reasonable that I might do my search for that something.

If that's the case then you're doing the second of the two searches, and if the NPM package wasn't in the results but its Github repo or homepage was you're still getting the results you wanted. For any search where you don't know what you want Google without NPM pages works fine. For any search where you do know what you want NPM's search function works fine. There isn't a case where you need Google to interleave pa…

> if the NPM package wasn't in the results but its Github repo or homepage was you're still getting the results you wanted

Or you're getting a GitHub page with a similar name, or worse, a malicious GitHub page that instructs you to download the npm package you're looking for from a typo squatted version of it.

Re: 50% of new NPM packages are spam

#110

Post by adql »

onion2k wrote: post #52
prepend wrote: post #41

Earlier quoted context omitted.

As a developer, I want npm package information and docs to show up in search. I frequently prefer pypi or cran results over others because then I can easily tell if it’s a usable package vs just some snippet. Especially cran because it has pretty rigorous entry requirements so being in cran is a signal of at least some minimal quality.

As a developer, I want npm package information and docs to show up in search. What case is there when you want to find a package in NPM, and information about that package, using Google? If you want information about the package then it's find if the NPM package page is missing from the results - so long as you're getting the package's homepage or git repo then that's plenty. From there you can get to it's NPM page.…

> What case is there when you want to find a package in NPM, and information about that package, using Google?

Coz you might want results not only from docs but stackoverflow and other places ?

> Essentially, there is no overlap in the Venn diagram of "searching for a package" and "searching for information about a package". You want one or the other, not a results page with links to both.

Of course there is. I want docs, examples, and maybe opinions vs alternatives if I look to solve problem X with external dependency.

Post reply on HN