Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

281–290 of 325 posts

Re: 50% of new NPM packages are spam

#281

Post by transitivebs »

wongarsu wrote: post #28
hollowturtle wrote: post #11

I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?

One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…

Trust is great; but even trust can be broken either on purpose or accidentally over time. There's a great example of a well-known NPM package which was taken over accidentally by a hacker, and the thousands / millions of dependent packages and apps were totally vulnerable.

Check out https://socket.dev for a better NPM solution (not affiliated w/ them at all), though AI's definitely going to accentuate this problem 1000x.

Re: 50% of new NPM packages are spam

#282

Post by stuckinhell »

ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

Resume Driven Development on Steroids these days for nearly everything.

Re: 50% of new NPM packages are spam

#283

Post by morkalork »

Aperocky wrote: post #239
ericmcer wrote: post #230

Earlier quoted context omitted.

I thought the same thing and researched how NPM packages get deleted. They need to be manually deleted by the owner and the safeguards are all to protect dependents. There is no incentive to maintain or cleanup old npm packages you have published. They really should have some kind of automated check to clean out packages that are years old, have no imports and no recent version changes. Especially when intuitive name…

> Especially when intuitive names are claimed by a 7 year old empty repo I wonder when we'll figure this out lol. The digital space is too young but once it existed for a while this must be taken care of to consider the natural human lifespan, retirement etc.

Nah, people will just make a new and improved packaging system and start over from scratch!

Re: 50% of new NPM packages are spam

#284

Post by squidsoup »

Hackbraten wrote: post #264
com2kid wrote: post #261

Earlier quoted context omitted.

For people who are lazy, one of the easiest ways to get code reuse in Node, especially if writing a package in TS that needs to be compiled, is to push it to NPM and import it in another project. Now days there are other, better, ways to do this, but for beginner and intermediate engineers, if you have some code in one Typescript repo, and you want to import/use it as a JS module in another repo, publishing to NPM is…

Which better ways are you referring to?

monorepos/workspaces presumably

Re: 50% of new NPM packages are spam

#285

Post by tcmart14 »

ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

Not to mention, it also throws off numbers when people try to talk about how great of an ecosystem is based off the number of packages. Sure, NPM may have a gazillion packages, but maybe only a few hundred thousand of them are actually useful? You see this same thing with cargo and crates.io. There are a lot of trash packages that are just generated either to squat on a name or maybe spammers or people going through the guide on learning how to publish packages to crates.io.

Re: 50% of new NPM packages are spam

#286

Post by ravenstine »

908B64B197 wrote: post #250
ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

> When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant…

Yep!

Of course, I think the game theory involved with this practice has been, at least at one point, more effective than having nothing to show at all.

Normally, I don't toot my own horn, but I was one of the few who published packages that actually did something, and something that was fairly unique at the time (I won't necessarily say good!), and the projects I showed off to prospective employers were things I did outside of bootcamp.

In my experience, very few employers, or those in charge of any level of hiring, will rarely if ever actually devote more than 10 seconds to anything on your portfolio. I know some will beg to differ, but that was my experience. It happens, but it's rare. At the time, one could have probably gotten away most of the time with merely claiming to have published open-source code or showing off how you got some GitHub stars. In retrospect, I can't say much of my honest portfolio work did for me other than act as learning experiences. Cranking out a bunch of garbage code would have sufficed for showing that I had some "skill" for landing my first job.

That ANSI code thing is funny as hell, though! I loathe what it represents, but admire how it proves a point by gaming the system. Also demonstrates my point that so much of what defines success in this field has been the mere appearance of even a shred of clout.

Re: 50% of new NPM packages are spam

#287

Post by throwaway290 »

ehutch79 wrote: post #36
JosephRedfern wrote: post #21

Earlier quoted context omitted.

I think the suggestion was that the revenue generated by NPM's commercial dealings should cover any cost associated with a review process for OSS submissions (which in itself would make such spam repositories ineffective)

So, let the spam happen, and remove it after the fact using humans? Or hold all submissions until a human reviews it?

Yes, the first one. Not exclusively with using humans to develop better detection of spam.

Re: 50% of new NPM packages are spam

#288

Post by segasaturn »

tremon wrote: post #187
delfinom wrote: post #161

Earlier quoted context omitted.

The world is based on making money. This can easily be a real developer working somewhere where their wages are dirt and this is a easy way to make money. Ethics and feelings don't make money or keep food on the table.

Ethics and feelings don't make money or keep food on the table. Do you have any suggestions on how to improve that situation?

[flagged]

Re: 50% of new NPM packages are spam

#289

Post by arpyzo »

Cthulhu_ wrote: post #219
ravenstine wrote: post #210

When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…

I wish they did reviews, but if half of the NPM packages are spam, that's still 172.000 legitimate NPM packages - per WEEK. That's not feasible to review. Are these new packages or version releases of existing packages as well? I think there's a market for a verified nodejs repository, where every package is reviewed, scanned and approved by a human + a heap of security tools. It wouldn't accept all updates of packag…

Would scanning packages be a perfect job for an AI?

edited for clarity

Re: 50% of new NPM packages are spam

#290

Post by salawat »

smallerfish wrote: post #147
wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

I think "immoral" is a reach as a description of spam, and to be crystal clear I'm not defending spam. How is spam any more immoral than ads in a web page? Both are inserting advertising into a channel that a user is accessing information through, as a way to raise revenue or change behavior. (Spam is not by definition phishing, any more than banner ads are innately phishing, though phishing can be served through bot…

Adtech is immoral. It has been immoral, it will remain immoral.

When you start diluting what people are actually looking for in an ocean of advertisement, malware, tracking pixels, and surveillance call-homes you've firmly left the territory of the moral.

Post reply on HN