Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

111–120 of 325 posts

Re: 50% of new NPM packages are spam

#111

Post by wongarsu »

mindcandy wrote: post #93
sokoloff wrote: post #38

Earlier quoted context omitted.

I would find amusement if the solution to the spamming of npm turns out to be a genuinely useful use case for blockchain.

One of the first proposals for blockchain was a email with a minuscule, verifiable fee to make email spam uneconomical. Spamming emails is one of the cheapest things you can do with a network connection. Even $1 per 1,000 emails would make spam untenable.

And the first proposal for proof-of-work was having emails include a proof-of-work to make it computationally expensive to mass-send emails.

Re: 50% of new NPM packages are spam

#112

Post by adql »

hollowturtle wrote: post #11

I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?

With AI it could even be fully working code.... hook some projects to use it as dep and replace with malware 6-12 months in

Re: 50% of new NPM packages are spam

#114

Post by chatmasta »

counttheforks wrote: post #44
leshenka wrote: post #30

Earlier quoted context omitted.

how do you garner enough downloads without being discoverable by Google?

Not npmjs.org's problem. Most languages their dependency managers don't give away indexed flashy web pages for free either, yet discoverability is usually not a problem.

Which languages have dependency managers with a public registry that is not indexed in Google? pypi.org and docs.rs are both indexed in Google, for example. With docs.rs it's even kind of annoying because often the indexed page is for an outdated version of the package.

There's really no reason why the same spammer couldn't target those sites too.

Re: 50% of new NPM packages are spam

#116

Post by criley2 »

ozim wrote: post #100
criley2 wrote: post #85

Earlier quoted context omitted.

I think you mean to say that you don't respect actors who justify their actions through "jealousy". In reality, jealously is a fine justification for actions and arguably the most used justification for any action in human history. Hard to think of a historical war that wasn't based on "jealousy", in the end. I kind of feel like your comment is like saying "Being poor isn't an excuse for stealing bread", and while co…

No he means “being poor isn’t an excuse for being asshole”. Just like keying your neighbor car because he could afford nice one is not acceptable whatever you feel like.

"Keying your neighbors car because they have a nicer one" is not an analogy that works for anything here.

What is happening in NPM is not a car being keyed. There is a profit motive for doing this.

Perhaps you could say "Stealing 1 gallon of gas from your rich neighbors car to feed your starving children makes you an asshole", that's an analogy that seems to fit what is happening here, and an opinion I would disagree with.

Re: 50% of new NPM packages are spam

#117

Post by pipo234 »

nine_k wrote: post #60
pipo234 wrote: post #7

Earlier quoted context omitted.

> - Cross-Internet reputation system for accounts Gets rid of anonymous spam. > - Small fee on submission Gets rid of amateur spam. I guess that's 98% of the problem. I think this is a good start. What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?

Small fees can't be the same for every country: say, what is small in the US is hefty in Kenya, and what is small in Kenya is negligible in the US.

...And of course the miscreants will always find a way to pay as little as possible. Sad, but true, there is no easy solution - at least not a fair one, probably.

Re: 50% of new NPM packages are spam

#118

Post by scrose »

It would be great if Sandworm listed these malicious repos in a text file that could be imported into a blocklist in a service like Pihole.

I’m not worried about hitting these URLs but definitely worry about the less tech savvy people in my family stumbling across these accidentally

Re: 50% of new NPM packages are spam

#119

Post by 11235813213455 »

ar9av wrote: post #96
wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

Probably an unpopular opinion, and I realize I'm kind of ranting on a relatively unrelated subject, but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees. The fact that Window's file system can't handle moving project directories (without deleting the node_modules), and relatively simple projects using megabytes of raw text to work... anyways. While I understan…

as a developer you can also keep a relatively low number of dependencies, and mainstream or simple ones

Re: 50% of new NPM packages are spam

#120

Post by Kye »

11235813213455 wrote: post #119
ar9av wrote: post #96

Earlier quoted context omitted.

Probably an unpopular opinion, and I realize I'm kind of ranting on a relatively unrelated subject, but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees. The fact that Window's file system can't handle moving project directories (without deleting the node_modules), and relatively simple projects using megabytes of raw text to work... anyways. While I understan…

as a developer you can also keep a relatively low number of dependencies, and mainstream or simple ones

That takes awareness and discipline. The last time I tried to learn Node, all the guides led you down a road of dependency hell.
Post reply on HN