Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

261–270 of 325 posts

Re: 50% of new NPM packages are spam

#261

Post by com2kid »

phkahler wrote: post #228
Cthulhu_ wrote: post #219

Earlier quoted context omitted.

I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review. Are these new packages or version releases of existing packages as well? I think there's a market for a verified nodejs repository, where every package is reviewed, scanned and approved by a human + a heap of security tools. It wouldn't accept all updates of packag…

>> I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review. It's also not feasible that many of then are good. Maybe packages should sit in a "new" state until a few reputable (not going to define that) projects make use of them or in some way recommend them.

For people who are lazy, one of the easiest ways to get code reuse in Node, especially if writing a package in TS that needs to be compiled, is to push it to NPM and import it in another project.

Now days there are other, better, ways to do this, but for beginner and intermediate engineers, if you have some code in one Typescript repo, and you want to import/use it as a JS module in another repo, publishing to NPM is an obvious way to do this.

Re: 50% of new NPM packages are spam

#262

Post by newswasboring »

alkonaut wrote: post #174
newswasboring wrote: post #8

Earlier quoted context omitted.

> Small fee on submission This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.

> I hope we don't ever make money a barrier to open source. Then make some other very cumbersome proof. But it's still better to cut off half the world from open source than pollute the few large software repositories with spam, which would dissuade everyone everywhere from contributing eventually. There's no problem contributing to a library from anywhere it's just that you collaborate with someone who in turn can p…

I don't understand this obsession with solving everything with money. It doesn't event solve this problem, just because someone payed the fee doesn't mean their code is not spam. You can't keep the fee small enough and still dissuade spammers.

Re: 50% of new NPM packages are spam

#263

Post by [deleted] »

sbarre wrote: post #259
smallerfish wrote: post #186

Earlier quoted context omitted.

> Or this is why you can't just go to any private space like a shopping mall with a megaphone and a sandwich board and start advertising your services without permission. Security will ask you to leave, because the owner of the mall didn't agree to this. You can certainly go to any public space and do this, however. People do it all the time (admittedly less frequently with megaphones). Are all of the people on stree…

> You can certainly go to any public space and do this, however. People do it all the time (admittedly less frequently with megaphones). Are all of the people on street corners doing twirlies with cardboard signs immoral? Billboards would be a gray area example whereby they're hosted on private resources (land) but intrude into public space (view from highway). Yes I specifically said private spaces for a reason. App…

[deleted]

Re: 50% of new NPM packages are spam

#264

Post by Hackbraten »

com2kid wrote: post #261
phkahler wrote: post #228

Earlier quoted context omitted.

>> I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review. It's also not feasible that many of then are good. Maybe packages should sit in a "new" state until a few reputable (not going to define that) projects make use of them or in some way recommend them.

For people who are lazy, one of the easiest ways to get code reuse in Node, especially if writing a package in TS that needs to be compiled, is to push it to NPM and import it in another project. Now days there are other, better, ways to do this, but for beginner and intermediate engineers, if you have some code in one Typescript repo, and you want to import/use it as a JS module in another repo, publishing to NPM is…

Which better ways are you referring to?

Re: 50% of new NPM packages are spam

#265

Post by ethicalsmacker »

newswasboring wrote: post #31
ethicalsmacker wrote: post #29

Earlier quoted context omitted.

If only there were some kind of decentralized digital currency a person could use outside of big banks and credit cards..

Dude I couldn't get a credit card in India, do you think a young person can easily get bitcoin? Its not that I was banned from getting it, its just that I couldn't afford it and getting it was really hard. Getting bitcoin, starting from fiat, is equally hard.

Woa woa, I never said bitcoin. I would never bring it up on HN, that's a recipe for downvotes.

Re: 50% of new NPM packages are spam

#266

Post by smallerfish »

sbarre wrote: post #259
smallerfish wrote: post #186

Earlier quoted context omitted.

> Or this is why you can't just go to any private space like a shopping mall with a megaphone and a sandwich board and start advertising your services without permission. Security will ask you to leave, because the owner of the mall didn't agree to this. You can certainly go to any public space and do this, however. People do it all the time (admittedly less frequently with megaphones). Are all of the people on stree…

> You can certainly go to any public space and do this, however. People do it all the time (admittedly less frequently with megaphones). Are all of the people on street corners doing twirlies with cardboard signs immoral? Billboards would be a gray area example whereby they're hosted on private resources (land) but intrude into public space (view from highway). Yes I specifically said private spaces for a reason. App…

The internet absolutely was a public space until the ads/walled garden model replaced it.

Re: 50% of new NPM packages are spam

#267

Post by nobody9999 »

lenzm wrote: post #213
nobody9999 wrote: post #203

There's been lots of discussion about blockchains, webs of trust, trusted reviews, small[0] fees and a host of other ideas to address npm package spam. I'll throw out another one: create an automated testing process for uploaded NPMs, such testing to be performed before allowing the new "package" to be visible to others. If the testing process can't find any code or if it really is a real package, but can't be succes…

This seems like an arms race doomed to failure. The spammers can just add Hello World to pass the check. Then the check could be upgraded to look for some non-trivial behavior. Then the spammers will work around that. ... all at increasing costs to the package hosts. And now they have to be arbiters on what counts as trivial functionality.

>This seems like an arms race doomed to failure. The spammers can just add Hello World to pass the check. Then the check could be upgraded to look for some non-trivial behavior. Then the spammers will work around that. ... all at increasing costs to the package hosts. And now they have to be arbiters on what counts as trivial functionality.

IIUC, most of these spam "packages" don't have any code at all, just a README with links to whatever malicious sites they want folks to visit.

As such, don't assume that just because someone uploads a spam package actually knows how to code anything, especially since it appears that such spam packages are uploaded not to scam Node devs, but to use the good reputation of npmjs.com to host their spammy content.

Getting rid of that stuff is the low-hanging fruit. And I would not be at all surprised if almost all of these these folks couldn't code anything useful or worthwhile in Node or any other language.

It's highly unlikely that most of the folks uploading these spam packages are node devs, or devs of any kind.

As such, most of these folks wouldn't be able to participate in an "arms race."

And while some tiny fraction of those folks might be an enterprising spammer who writes an actual npm package. The problem with that, of course, is that it's quite likely that it's just a small number of folks who are uploading dozens (hundreds?) of these "packages," forcing them to either reuse the code over and over again (which is fairly easy to spot) or to actually develop new code for each package.

And that's way too resource intensive for scammers. If they were folks who had skills, decent work ethic and/or an interest in anything other than running their scams, they wouldn't be posting fake (i.e., just an empty package with a README) packages in an attempt to use npmjs.com to host their crap.

I mean, I get it. Perhaps you made the assumption that these folks are actually devs? Since they're using the site -- but IIUC, there's no proof that's the case -- at least for the specific empty packages I referenced above.

Edit: Clarified my thoughts.

Re: 50% of new NPM packages are spam

#268

Post by scrose »

VWWHFSfQ wrote: post #149
scrose wrote: post #118

It would be great if Sandworm listed these malicious repos in a text file that could be imported into a blocklist in a service like Pihole. I’m not worried about hitting these URLs but definitely worry about the less tech savvy people in my family stumbling across these accidentally

how would pihole block these though

It was too early for me when I posted this :)

There were two ideas in mind that were conflated: 1) A list for blocking the subpaths of these packages in npm that could be imported. 2) A list for blocking the malicious URLs in the repos themselves. Ie they mentioned that the repos have malicious URLs that navigate you off the page. This is where something like pihole could come in handy.

Re: 50% of new NPM packages are spam

#269

Post by sbarre »

smallerfish wrote: post #266
sbarre wrote: post #259

Earlier quoted context omitted.

> You can certainly go to any public space and do this, however. People do it all the time (admittedly less frequently with megaphones). Are all of the people on street corners doing twirlies with cardboard signs immoral? Billboards would be a gray area example whereby they're hosted on private resources (land) but intrude into public space (view from highway). Yes I specifically said private spaces for a reason. App…

The internet absolutely was a public space until the ads/walled garden model replaced it.

You and I have different definitions of public space.

I've been on the net since the early 90s, and even back then there were no public spaces.

There is nowhere online, and really never has been, where you have a right to be, or where you can express your government-given rights (also, which government? most of us are not US citizens) without anyone having the ability to cut you off or kick you out at their own discretion.

Every server, whether it was Usenet, IRC, the web, email, or otherwise, was, and is, owned by a private entity that could moderate, manage and restrict usage as they see fit.

If you cause them enough trouble, they will boot you, and have every right to do so.

I don't call that public spaces.

Re: 50% of new NPM packages are spam

#270

Post by cxr »

ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

> I always despised how this effectively trashes the repository

The followup assignment should have been teaching the value of taking care of your environment by cleaning up after yourself.

Post reply on HN