Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

221–230 of 325 posts

Re: 50% of new NPM packages are spam

#221

Post by zokier »

Cthulhu_ wrote: post #219
ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review. Are these new packages or version releases of existing packages as well? I think there's a market for a verified nodejs repository, where every package is reviewed, scanned and approved by a human + a heap of security tools. It wouldn't accept all updates of packag…

"RHEL" model for nodejs? Why not, but finding enough people willing to actually pay for it will probably be difficult

Re: 50% of new NPM packages are spam

#222

Post by lesquivemeau »

Hnrobert42 wrote: post #205
lesquivemeau wrote: post #172

I was expecting this article to be a promotion of their audit tool considering a thread about it was flagged as spam less than two weeks ago[1] Turns out it indeed is. Interesting article nonetheless, but it's quite ironic that it's about spam [1] https://news.ycombinator.com/item?id=35233877

Hmm. I found this article informative. I suppose it did mention their service, but only toward the end. Even then, it wasn’t like “Buy now for 50% off!!!” So on balance, I am glad they posted.

I 100% agree with you on that point

Re: 50% of new NPM packages are spam

#223

Post by chatmasta »

onion2k wrote: post #141
chatmasta wrote: post #105

Earlier quoted context omitted.

What? Nearly every time I search a package name in Google, I'm trying to get to the npm page. And I want to find the matching npm page so I can click from there to the associated GitHub, since it's the most trustworthy way to know I'm browsing the source of that specific package.

Nearly every time I search a package name in Google, I'm trying to get to the npm page. This is exactly the point I'm making. It's very rare that you want both NPM package pages and internet results. If NPM wasn't indexed it'd solve the spam problem, and the only cost would be people would need to think about what they're looking for and use NPM's search instead when they want the package page.

Ok, I see your point, but this creates another risk that you could end up on the GitHub page of an imposter repository that directs you to npm install from a typo-squatted malicious version of the package you're looking for.

Re: 50% of new NPM packages are spam

#224

Post by verdverm »

nailer wrote: post #156
verdverm wrote: post #68

Earlier quoted context omitted.

sounds like twitter's new strategy

It's a good strategy. Suddenly spam costs money.

Does spam costing more money stop spam? Does it cost money per account, project, version? If I can make $100 from one victim, is this spam still profitable?

What happens to the international developers who cannot easily get a payment method setup?

Does a $10/m "identity verification" stop a nation state from using the platform to influence?

Re: 50% of new NPM packages are spam

#226

Post by thenerdhead »

lesquivemeau wrote: post #172

I was expecting this article to be a promotion of their audit tool considering a thread about it was flagged as spam less than two weeks ago[1] Turns out it indeed is. Interesting article nonetheless, but it's quite ironic that it's about spam [1] https://news.ycombinator.com/item?id=35233877

This is common in the "security" space.

i.e. Dunk on an ecosystem, promote your tool that somehow "makes it better", but ultimately doesn't help the problem.

Source: I work on a notable package manager where this happens regularly.

Re: 50% of new NPM packages are spam

#227

Post by bryanrasmussen »

swyx wrote: post #155
themitigating wrote: post #75

Earlier quoted context omitted.

Yes but they don't care. Some people don't care if they are immoral. That's why you need regulations and punishments to stop them.

and yet the collateral cost of regulations and punishments on good/innocent people is often far worse than the damage caused by spammers. "regulate all the things" people often underestimate how poorly regulation solves the problems they set out to solve and how it often creates new ones.

I guess my AmazingProject https://github.com/bryanrasmussen/AmazingProject that I made 97% as a joke when someone was running a code camp or whatever and a bunch of newbies where creating projects with the word Amazing in it would be grounds for punishment under a lot of regulatory regimes.

Re: 50% of new NPM packages are spam

#228

Post by phkahler »

Cthulhu_ wrote: post #219
ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review. Are these new packages or version releases of existing packages as well? I think there's a market for a verified nodejs repository, where every package is reviewed, scanned and approved by a human + a heap of security tools. It wouldn't accept all updates of packag…

>> I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review.

It's also not feasible that many of then are good.

Maybe packages should sit in a "new" state until a few reputable (not going to define that) projects make use of them or in some way recommend them.

Re: 50% of new NPM packages are spam

#229

Post by dtagames »

Cthulhu_ wrote: post #219
ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review. Are these new packages or version releases of existing packages as well? I think there's a market for a verified nodejs repository, where every package is reviewed, scanned and approved by a human + a heap of security tools. It wouldn't accept all updates of packag…

It certainly is possible to review them with an LLM.

Re: 50% of new NPM packages are spam

#230

Post by ericmcer »

ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

I thought the same thing and researched how NPM packages get deleted. They need to be manually deleted by the owner and the safeguards are all to protect dependents. There is no incentive to maintain or cleanup old npm packages you have published.

They really should have some kind of automated check to clean out packages that are years old, have no imports and no recent version changes. Especially when intuitive names are claimed by a 7 year old empty repo so you have to name your project rhino-edit or some bs.

Post reply on HN