Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

181–190 of 325 posts

Re: 50% of new NPM packages are spam

#181

Post by robertlagrant »

oleks wrote: post #89
criley2 wrote: post #63

Earlier quoted context omitted.

The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…

> The people who do this are likely not American or Western European Maybe not natively, but they may be working in the US or Western Europe, making upwards 50% of a Google/Facebook salary, if not working at Google/Facebook indeed. Plenty of companies pay a decent salary for mediocre work, and will take the less morally sound developer, because the sound one isn't willing to work with their legacy code or less moral…

I mean. Given the world as we know it would become impoverished overnight without them, it's hard to see how oil and financial services industries can be seen as immoral. Imperfect, certainly, but immoral?

Re: 50% of new NPM packages are spam

#182

Post by zaroth »

eddieroger wrote: post #123
wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

You don't know what circumstances the other party, the spammer, is under in this situation. On one end, maybe they just don't care, which is certainly their choice. Maybe this is the difference between eating tonight or not, or feeding their family. We may think it's immoral, but those are in the light of our own circumstances.

This is way beyond moral relativism and even ends justify the means type thinking…

It makes no sense to equivocate over the bad things people do by asking everyone to assume the perp had a figurative gun to their head.

What this dev did was absolutely immoral. Trashing a commons in an attempt to scam end users is objectively wrong.

Seems very strange to chastise OP for pointing this out based on a wild theory that the dev literally had no other choice.

Re: 50% of new NPM packages are spam

#183

Post by sebzim4500 »

sirius87 wrote: post #16

Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd

Presumably this will only start to happen more when LLMs are being trained on this kind of data. For example, every training corpus weights Wikipedia way higher than random websites/forum posts, so sticking an ad for your product on some random article that no one looks at will get it into the model.

Re: 50% of new NPM packages are spam

#185

Post by millerm »

vidyesh wrote: post #157
millerm wrote: post #129

Earlier quoted context omitted.

Many years ago I quit my job at a search engine company for my personal ethics, because they had me start manipulating search results based on who paid for their entries.

Good on you to stand by your ethics. This is the way.

Currently unemployed now (not due to ethics, but due to culling of tech jobs). I'm screwed. I won't take an unethical gig though. I have mentioned it before, I think my time is done here. :-/

Re: 50% of new NPM packages are spam

#186

Post by smallerfish »

sbarre wrote: post #158
smallerfish wrote: post #147

Earlier quoted context omitted.

I think "immoral" is a reach as a description of spam, and to be crystal clear I'm not defending spam. How is spam any more immoral than ads in a web page? Both are inserting advertising into a channel that a user is accessing information through, as a way to raise revenue or change behavior. (Spam is not by definition phishing, any more than banner ads are innately phishing, though phishing can be served through bot…

Because, like so many things, context matters. Ads have a place in the world, where we expect to see them (whether we like them or not), and typically most ads are not trying to pass as non-ads (yes of course there are exceptions to this). The difference here is that these exist in a place where ads should not be, as per the description and use of the service. And it also subverts the experience the service owner is…

> Or this is why you can't just go to any private space like a shopping mall with a megaphone and a sandwich board and start advertising your services without permission. Security will ask you to leave, because the owner of the mall didn't agree to this.

You can certainly go to any public space and do this, however. People do it all the time (admittedly less frequently with megaphones). Are all of the people on street corners doing twirlies with cardboard signs immoral? Billboards would be a gray area example whereby they're hosted on private resources (land) but intrude into public space (view from highway).

> Imagine if you accept a "free sample" box of cereal and you get home and open it and it's just full of flyers, instead of being full of cereal.

Imagine if you accept a "free social media feed" of information about your community, and you "get home" and it's full of ads. Or you accept a "free article" from a website by clicking on a link, and when you load it (consuming bandwidth on a line that you paid for), it contains just as many ads as it does paragraphs of information.

As I said, I'm not defending spam in general (which is obnoxious), or the act of the person/people who polluted/vandalized the npm repos. I just think "immoral" is a little strong unless you also want to paint much of the rest of the ad world with the same brush.

Re: 50% of new NPM packages are spam

#187

Post by tremon »

delfinom wrote: post #161
wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

The world is based on making money. This can easily be a real developer working somewhere where their wages are dirt and this is a easy way to make money. Ethics and feelings don't make money or keep food on the table.

Ethics and feelings don't make money or keep food on the table.

Do you have any suggestions on how to improve that situation?

Re: 50% of new NPM packages are spam

#188

Post by alkonaut »

Just raise the barriers for contribution. Can't have completely open systems and simultaneously not have them be cesspools of spam and malicious packages. E.g. either get approval from N contributors of existing highly regarded packages, or pay an administrative fee for publishing new packages.

Re: 50% of new NPM packages are spam

#189

Post by LegionMammal978 »

ar9av wrote: post #96
wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

Probably an unpopular opinion, and I realize I'm kind of ranting on a relatively unrelated subject, but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees. The fact that Window's file system can't handle moving project directories (without deleting the node_modules), and relatively simple projects using megabytes of raw text to work... anyways. While I understan…

> Probably an unpopular opinion... but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees.

I wouldn't be quite so dramatic about that; HN as a collective loves complaining about NPM and dependency trees. (At the same time, it loves complaining about NIH syndrome. Although I suppose existent but limited dependency trees are far from an impossibility.)

E.g., https://news.ycombinator.com/item?id=35243196, https://news.ycombinator.com/item?id=35210975, https://news.ycombinator.com/item?id=35070210, https://news.ycombinator.com/item?id=34940437, https://news.ycombinator.com/item?id=34932957, https://news.ycombinator.com/item?id=34785080, https://news.ycombinator.com/item?id=34779769, https://news.ycombinator.com/item?id=34768828, https://news.ycombinator.com/item?id=34708290, https://news.ycombinator.com/item?id=34686056, ...

Re: 50% of new NPM packages are spam

#190

Post by nextlevelwizard »

hollowturtle wrote: post #11

I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?

Is it common to randomly browse npm for packages to use? Sure AI can create a copy of existing package with malware in it, but so can anyone else. It is harder to fake years of posts and community around a package that anyone might actually use.
Post reply on HN