3 ms·

Genuinely curious: why is malware always discovered in npm packages, and not pip (python), gradle/maven (JVM), cabal (Haskell), cargo (Rust), CRAN (R), etc.? Or

• swiley 5y ago
  I thought someone happened in pip the other year. Part of the NPM issue is that everything gets atomized into tiny libraries and no one seems to care about the dependency explosion.
• Angius 5y ago
  It's an attractive target. Other ecosystems (maybe besides Rust) rely on large packages with minimal dependencies, and those packages are often first-party (Entity Framework, for example). NPM meanwhile is a neverending net of tiny oneliner packages, required by other oneliner packages, required by twoliner packages, required by single-function packages, required by... required by React. And thus, adding malware to `is-number` adds it to all 8766235452 packages that depend on it.
• tommek4077 5y ago
  The older such a system is, the more there is a "don't trust anyone" mentality. Some decades in the past you did not just run alien code in your system. Edit: without looking at it beforehand
• moreati 5y ago
  It isn't always just in NPM, although NPM might be more targetted and/or more publicised. There have been cases in PyPI (e.g. https://labs.sogeti.com/analysis-of-the-biggest-python-supply-chain-attack-ever/ https://labs.sogeti.com/analysis-of-the-biggest-python-suppl..., https://thehackernews.com/2021/08/pypi-python-package-repository-patches.html https://thehackernews.com/2021/08/pypi-python-package-reposi...), and probably others too, but PyPI is the one I care about.
• schleck8 5y ago
  There definitely is malware around on PyPI, and typosquatting.