Shai-Hulud Returns: Over 300 NPM Packages Infected

Post by YouAreWRONGtoo » Mon, Nov 24, 2025, 4:18 PM UTC

kortex wrote: post #419

shadymoney wrote: post #407

This is why I am not a huge fan of separate package managers for libraries, such as in the case of rust, or node. The C style of sharing deps. couldn't really be simpler as just including the headers in your Makefile. We really don't need more package managers other than the ones provided by your operating system, but I dunno maybe its just me.

That ship has sailed, traveled around the world, and docked in a foreign port at this point. Including headers isn't remotely "simple". There's so many considerations in linking, .SO version compatibility, architecture and instruction set issues, building against multiple versions on the same system. Or if you want to feel frustrated in a single word: GDAL (IYKYK) And that's only where #include is even applicable. Th…

Post by redwall_hp » Mon, Nov 24, 2025, 4:20 PM UTC

jml78 wrote: post #257

amiga386 wrote: post #172

Earlier quoted context omitted.

An example: Java Maven artifacts typically name the exact version of their dependencies. They rarely write "1.2.3 or any newer version in the 1.2.x series ", as is the de-facto standard in NPM dependencies. Therefore, it's up to each dependency-user to validate newer versions of dependencies before publishing a new version of their own package. Lots of manual attention needed, so a slower pace of releases. This is a…

You forgot to mention it is also tied to provable namespaces. People keep saying that NPM is just the biggest target... Hate to break it to you but from targeting enterprises, java maven artifacts would be a MASSIVE target. It is just harder to compromise because NPM is such shit.

Post by shadymoney » Mon, Nov 24, 2025, 4:24 PM UTC

kortex wrote: post #419

shadymoney wrote: post #407

This is why I am not a huge fan of separate package managers for libraries, such as in the case of rust, or node. The C style of sharing deps. couldn't really be simpler as just including the headers in your Makefile. We really don't need more package managers other than the ones provided by your operating system, but I dunno maybe its just me.

That ship has sailed, traveled around the world, and docked in a foreign port at this point. Including headers isn't remotely "simple". There's so many considerations in linking, .SO version compatibility, architecture and instruction set issues, building against multiple versions on the same system. Or if you want to feel frustrated in a single word: GDAL (IYKYK) And that's only where #include is even applicable. Th…

Post by jbverschoor » Mon, Nov 24, 2025, 4:26 PM UTC

Post by windward » Mon, Nov 24, 2025, 4:29 PM UTC

QuiEgo wrote: post #361

TheFlyingFish wrote: post #70

Earlier quoted context omitted.

I've worried about this for a while with Rust packages. The total size of a "big" Rust project's dependency graph is pretty similar to a lot of JS projects. E.g. Tauri, last I checked, introduces about 600 dependencies just on its own. Like another commenter said, I do think it's partially just because dependency management is so easy in Rust compared to e.g. C or C++, but I also suspect that it has to do with the si…

It's already happening: https://cyberpress.org/malicious-rust-packages/ My personal experience (YMMV): Rust code takes 2x or 3x longer to write than what came before it (C in my case), but in the end you usually get something much more likely to work, so overall it's kind of a wash, and the product you get is better for customers - you basically front load the cost of development. This is terrible for people working…