Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

211–220 of 325 posts

Re: 50% of new NPM packages are spam

#211

Post by miohtama »

Hnrobert42 wrote: post #205
lesquivemeau wrote: post #172

I was expecting this article to be a promotion of their audit tool considering a thread about it was flagged as spam less than two weeks ago[1] Turns out it indeed is. Interesting article nonetheless, but it's quite ironic that it's about spam [1] https://news.ycombinator.com/item?id=35233877

Hmm. I found this article informative. I suppose it did mention their service, but only toward the end. Even then, it wasn’t like “Buy now for 50% off!!!” So on balance, I am glad they posted.

I am not any way affiliated with the company and I did the submission. I do believe that informative blog posts by industry insider should be allowed and it is not bad practice to promote your company. Especially on HackerNews where it is relevant for audience (no conflict of interest with YCombinator funded companies?).

Otherwise any SaaS ecosystem could become AWS/Google/Microsoft well known names only. Rules should be also equally applied. E.g. Each GitHub blog post promotes GitHub and thus Microsoft.

Re: 50% of new NPM packages are spam

#212

Post by dspillett »

EVa5I7bHFq9mnYK wrote: post #191

Anything free will be abused for spam. Make it pay a small fee to add an npm package, and the problem will disappear. The fee may be going to pay for moderation, for example. To make payments frictionless and anonymous, accept cryptocurrency.

> Make it pay a small fee to add an npm package, and the problem will disappear.

As will many useful packages because people just won't bother no matter how small the small fee is. For some they simply can't (no access to internation payment systems), for others they simply won't want the extra admin (I know I wouldn't, being lazy^H^H^H^Htime-efficient as I am).

A free alternative will spring up, many will move to that, and once it becomes significant enough it'll become a spam target, and we are back where we began except things are a bit more fragmented so less convenient for all.

> To make payments frictionless and anonymous, accept cryptocurrency.

That still blocks some financially (what if someone can ill afford any currency, crypto or otherwise?) and many on “why should I bother” (I don't have any crypto accounts, I have to learn a new system to pay someone so I can give my stuff away for free?).

This also breaks the small fee matter. If the fee is genuinely small enough it is very easy for an effective spammer to socially engineer a few bits of cryptocurrency out of an innocent fool.

Re: 50% of new NPM packages are spam

#213

Post by lenzm »

nobody9999 wrote: post #203

There's been lots of discussion about blockchains, webs of trust, trusted reviews, small[0] fees and a host of other ideas to address npm package spam. I'll throw out another one: create an automated testing process for uploaded NPMs, such testing to be performed before allowing the new "package" to be visible to others. If the testing process can't find any code or if it really is a real package, but can't be succes…

This seems like an arms race doomed to failure. The spammers can just add Hello World to pass the check. Then the check could be upgraded to look for some non-trivial behavior. Then the spammers will work around that. ... all at increasing costs to the package hosts. And now they have to be arbiters on what counts as trivial functionality.

Re: 50% of new NPM packages are spam

#214

Post by readertime »

onion2k wrote: post #180
sbarre wrote: post #168

Earlier quoted context omitted.

You're trying real hard to tell people how they _shouldn't_ be doing their work, maybe accept that your opinion, while valid, is just that - your opinion - and that others have their own equally valid ways of approaching their work and their searching?

I'm suggesting that it wouldn't be a problem if NPM switched off indexing, and if the article is correct that half of packages are spam then it'd actually be significantly beneficial. The broader point is that by expecting Google to be a single interface to the entire internet, and refusing to accept that there might be some places you need to go to directly, we make the problem of spam worse. Using Google for naviga…

But I want a single search bar that just magically gives me the right results. Given the enthusiasm for GPTn I think a lot of people do too.

Whether that incentivized spammers to spam, or Google et al to improve their software (or risk being outcompeted), doesn’t really seem like a “me” problem. I can’t change these things.

Re: 50% of new NPM packages are spam

#215

Post by franky47 »

Ciantic wrote: post #26
sirius87 wrote: post #16

Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd

If the spammers only want to be indexed, then NPM should disable indexing for major search engines. But still allow it to be indexed other ways, which aren't unearthed on Google search. Other ideas include: do not index new packages before they've garnered enough downloads.

> Other ideas include: do not index new packages before they've garnered enough downloads.

Which would be trivial to automate.

Re: 50% of new NPM packages are spam

#216

Post by [deleted] »

ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

[deleted]

Re: 50% of new NPM packages are spam

#217

Post by madeofpalk »

lookdangerous wrote: post #83
madeofpalk wrote: post #77

Earlier quoted context omitted.

> but doing that to an open source repository meh. It's owned by Microsoft - aside from the regular morals of spam and whatever, I don't think it's especially bad to target a Microsoft property. How much of the NPM registry actually is open source?

How about instead of who owns it, ask who uses it?

I use NPM regularly and I've never been impacted by this spam.

Re: 50% of new NPM packages are spam

#219

Post by Cthulhu_ »

ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review.

Are these new packages or version releases of existing packages as well?

I think there's a market for a verified nodejs repository, where every package is reviewed, scanned and approved by a human + a heap of security tools. It wouldn't accept all updates of packages, because the volume would be too high. It would have to be a paid for service though, aimed at enterprises.

Re: 50% of new NPM packages are spam

#220

Post by not_your_vase »

flanbiscuit wrote: post #200
tyingq wrote: post #17

Searching for the string "down_load_ebook" does unearth a lot of packages. https://www.npmjs.com/search?q=down_load_ebook About 100k spam packages, with no false positives that I can see.

wow 104,395 packages found So far the oldest package release I've seen was only 7 days go, all authored by uniquely generated name with the same format: Random First Name + Random Last Name + Random 4 numbers Interesting that npm lists 5,219 pages of results but errors at anything past page 2000. https://www.npmjs.com/search?q=down_load_ebook&page=2000&per...

And very informatively the HTTP error code is "418 - I'm a Teapot" at page 2001.

(Though the response body does say "out of bound", so it's not all bad. I guess this amount of fun is allowed.)

Post reply on HN