Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

Post reply on HN
Print view View original

141–150 of 325 posts

Re: 50% of new NPM packages are spam

#141

Post by onion2k »

chatmasta wrote: post #105
onion2k wrote: post #52

Earlier quoted context omitted.

As a developer, I want npm package information and docs to show up in search. What case is there when you want to find a package in NPM, and information about that package, using Google? If you want information about the package then it's find if the NPM package page is missing from the results - so long as you're getting the package's homepage or git repo then that's plenty. From there you can get to it's NPM page.…

What? Nearly every time I search a package name in Google, I'm trying to get to the npm page. And I want to find the matching npm page so I can click from there to the associated GitHub, since it's the most trustworthy way to know I'm browsing the source of that specific package.

Nearly every time I search a package name in Google, I'm trying to get to the npm page.

This is exactly the point I'm making. It's very rare that you want both NPM package pages and internet results. If NPM wasn't indexed it'd solve the spam problem, and the only cost would be people would need to think about what they're looking for and use NPM's search instead when they want the package page.

Re: 50% of new NPM packages are spam

#142

Post by dmux »

sirius87 wrote: post #16

Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd

They must do a pretty good job of automating the removal of such packages because I get a 404 from that link.

Re: 50% of new NPM packages are spam

#143

Post by Kye »

nonethewiser wrote: post #132
Kye wrote: post #120

Earlier quoted context omitted.

That takes awareness and discipline. The last time I tried to learn Node, all the guides led you down a road of dependency hell.

Not following a guide takes awareness and discipline too. Furthermore, if you are simply learning Node, aren’t the downsides of dependencies moot?

Tolerating an iceberg of bad habits under a surface of abstractions is a way to get up to speed on something fast, but you eventually have to invest time learning better ways to do things. Except in web development where it's normal to send multi-megabyte blobs to the browser.

Re: 50% of new NPM packages are spam

#144

Post by onion2k »

adql wrote: post #110
onion2k wrote: post #52

Earlier quoted context omitted.

As a developer, I want npm package information and docs to show up in search. What case is there when you want to find a package in NPM, and information about that package, using Google? If you want information about the package then it's find if the NPM package page is missing from the results - so long as you're getting the package's homepage or git repo then that's plenty. From there you can get to it's NPM page.…

> What case is there when you want to find a package in NPM, and information about that package, using Google? Coz you might want results not only from docs but stackoverflow and other places ? > Essentially, there is no overlap in the Venn diagram of "searching for a package" and "searching for information about a package". You want one or the other, not a results page with links to both. Of course there is. I want…

Coz you might want results not only from docs but stackoverflow and other places ?

Of course there is. I want docs, examples, and maybe opinions vs alternatives if I look to solve problem X with external dependency.

You don't need the link to the package in NPM to be in the results for either of these examples.

Re: 50% of new NPM packages are spam

#145

Post by nailer »

ar9av wrote: post #96
wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

Probably an unpopular opinion, and I realize I'm kind of ranting on a relatively unrelated subject, but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees. The fact that Window's file system can't handle moving project directories (without deleting the node_modules), and relatively simple projects using megabytes of raw text to work... anyways. While I understan…

> The fact that Window's file system can't handle moving project directories (without deleting the node_modules)

Windows-based developer here. Don't use Windows node. Use the Linux x64 build in WSL.

Re: 50% of new NPM packages are spam

#147

Post by smallerfish »

wruza wrote: post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

I think "immoral" is a reach as a description of spam, and to be crystal clear I'm not defending spam. How is spam any more immoral than ads in a web page? Both are inserting advertising into a channel that a user is accessing information through, as a way to raise revenue or change behavior. (Spam is not by definition phishing, any more than banner ads are innately phishing, though phishing can be served through both mediums.) If spam is _immoral_ then why is adtech in general not _immoral_?

Re: 50% of new NPM packages are spam

#149

Post by VWWHFSfQ »

scrose wrote: post #118

It would be great if Sandworm listed these malicious repos in a text file that could be imported into a blocklist in a service like Pihole. I’m not worried about hitting these URLs but definitely worry about the less tech savvy people in my family stumbling across these accidentally

how would pihole block these though

Re: 50% of new NPM packages are spam

#150

Post by bambax »

> ... SEO spam. That is - empty packages, with just a single README file (...) All the identified spam packages are currently live on npmjs.com

How is that possible? It seems it would be trivial to filter out spam based just on the observation above, why is it not done?

(I'm (obviously) not familiar with the process of submitting an NPM package, so I'm genuinely curious how this works).

Post reply on HN