Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

70% of new NPM packages in last 6 months were spam

blog.phylum.io

Post reply on HN
Print view View original

81–90 of 116 posts

Re: 70% of new NPM packages in last 6 months were spam

#81

Post by brynb »

lolinder wrote: post #58
wesselbindt wrote: post #35

Earlier quoted context omitted.

Principles are a means to an end, not an end in themselves. The end here (presumably) is a healthy ecosystem, an end which this principle arguably harms more than it helps. Rigid and unthinking adherence to principles is dogmatic, and dogma has no place in engineering.

> The end here (presumably) is a healthy ecosystem More specifically, the end here is a package manager that doesn't randomly start break your builds because a dependency you need can just vanish from the main servers or lose files you expected to be there. That may or may not contribute to a healthy ecosystem, but it definitely contributes to widespread usage of npm.

if you've been duped into importing a package which has been broadly deemed as spam (but you're not looped into the public conversation about that fact enough to realize it), wouldn't "breaking the build" be a good way to get you to realize your folly and avoid the trap?

Re: 70% of new NPM packages in last 6 months were spam

#82

Post by barryrandall »

yamumzahoe wrote: post #74
3np wrote: post #24

Earlier quoted context omitted.

That would be a clear violation of the npm Unpublish Policy[0]. If all it takes is some spam and pissing people off to walk away from principles, they never meant anything. A proper response needs to not break expectations like this. [0]: https://docs.npmjs.com/policies/unpublish

[flagged]

Leave the packages online, but remove them from indexes and require --force to install them.

Re: 70% of new NPM packages in last 6 months were spam

#83

Post by pixl97 »

minkles wrote: post #9
EVa5I7bHFq9mnYK wrote: post #4

Spam is the least of the worries.

Yeah this when I see one of our pipelines pull in 300 npm packages I wonder how much we really know about what our systems do.

Heh, I work in a sector that works with some very large companies we all know the names of. I've seen applications that are seemingly very little code written by them but hundreds or thousands of packages/modules glued together. It is quite common that the tooling they use catch 'low reputation' packages where they've actually put the wrong package name in, then when it didn't work, add the package they needed but didn't remove the misnamed package.

Completely terrifying to me.

Re: 70% of new NPM packages in last 6 months were spam

#85

Post by brynb »

3np wrote: post #25
NikxDa wrote: post #2

> Contrary to what npm states, this package actually depends on one of our aforementioned spam packages. This is a by-product of how npm handles and displays dependencies to users on its website. For me personally, this is the biggest surprise and takeaway here. By simply having a key inside package.json's dependencies reference an existing NPM package, the NPM website links it up and counts it as a dependency, regar…

You should think of the package metadata as originating from the publisher, not from the registry. Aside from the name, version, and (generated) dist and maintainers fields, I don't think any of it is even supposed to be validated by the registry? Agreed the website UX is confusing and could be better but in general package metadata is just whatever the publisher put there and it's up to you to verify if you care abo…

this is a little too stoic a take with respect to a tool that very unserious people building things for serious but non-technical people use on a daily basis. i think we should strive for more. npm can continue to exist in its very libertarian form, but perhaps there's room for something that cares a bit more about caution

Re: 70% of new NPM packages in last 6 months were spam

#86

Post by thfuran »

Joker_vD wrote: post #56
mkl wrote: post #8

How about removing the incentive? Take down every package with tea.yaml in it, after say 1 month's warning, so legitimate packages trying to use it don't leave their users in the lurch. The tea protocol is clearly not going to accomplish what it set out to (see below), and is instead incentivising malicious behaviour and damaging the system it set out to support. From https://docs.tea.xyz/tea/i-want-to.../faqs : "tea…

> allowing open-source developers to capture the value they create But... then why would I use their code if whatever value it creates is captured by them the developers and so I am no better from where I was? That's like paying your employees the additional value they produce instead of the market wages: you then literally have no reason to hire them since their work is exactly profit-neutral.

As if the only goal a potential employer could possibly have is to accrue capital.

Re: 70% of new NPM packages in last 6 months were spam

#87

Post by lupire »

brynb wrote: post #79
sushibowl wrote: post #61

Earlier quoted context omitted.

> The JS ecosystem encourages using a million tiny unmaintained packages and that is bad continuing on this, I wonder if this is a cultural thing or if there are actual technical choices made in NPM that play a role. Could NPM change something in their package management to change this? Should they?

it's language-cultural. to "publish a package" in Go simply means having a public git repository. and yet, nobody who writes Go imports packages. it's well-understood that if you can't write something like leftpad (or many other JS packages) yourself in your own codebase in a few lines, you're an absolute nonce. Javascript developers on the other hand tend to skew towards the juniors in our broader ecosystem, and the…

So no one uses all those Go libraries on GitHub? Hmmm except pedophiles? What is wrong with you?

Re: 70% of new NPM packages in last 6 months were spam

#88

Post by tdb7893 »

mkl wrote: post #8

How about removing the incentive? Take down every package with tea.yaml in it, after say 1 month's warning, so legitimate packages trying to use it don't leave their users in the lurch. The tea protocol is clearly not going to accomplish what it set out to (see below), and is instead incentivising malicious behaviour and damaging the system it set out to support. From https://docs.tea.xyz/tea/i-want-to.../faqs : "tea…

I combed through their docs to try to find how these tokens would actually make maintainers money and it seems like it people pay projects for fixing bug reports (and penalize them if they don't)? The other demand drivers of the token seem to just be shuffling money around and are at best a pyramid scheme. I'm a little confused how someone seriously thought this was gonna be a good idea.

Re: 70% of new NPM packages in last 6 months were spam

#89

Post by marginalia_nu »

lolinder wrote: post #69
marginalia_nu wrote: post #64

Earlier quoted context omitted.

We can empirically observe that NPM-sphere is relatively alone among software ecosystems to have this particular problem. This is an indication that the problem is either with some facet of NPM itself, javascript the language or js programmers, as that is what distinguishes the ecosystem from e.g. Maven or Pip that do not suffer from the same problems, at least not to the same extent. However, going from this observa…

You're doing it again, though: are "this particular problem" and "these problems" the tea.yaml spam? The million tiny packages problem I mentioned? The fact that people online will generically attack the ecosystem without being specific about their complaints? I'm not asking for solutions, and I'm not asking for people to identify casual factors. I'm asking for people to put a little bit more effort into their critic…

"70% of new NPM packages in last 6 months were spam"

Re: 70% of new NPM packages in last 6 months were spam

#90

Post by dgfitz »

pdimitar wrote: post #73
lolinder wrote: post #66

Earlier quoted context omitted.

Which, incidentally, some people seem to have forgotten when suggesting that NPM should start deleting things en masse.

What other outcome than "curation" do you see as a solution of the "bloat" problem?

A new npm-esque?
Post reply on HN