2 ms·
> ... SEO spam. That is - empty packages, with just a single README file (...) All the identified spam packages are currently live on npmjs.com How is that pos
by bambax 4y ago
> ... SEO spam. That is - empty packages, with just a single README file (...) All the identified spam packages are currently live on npmjs.com
How is that possible? It seems it would be trivial to filter out spam based just on the observation above, why is it not done?
(I'm (obviously) not familiar with the process of submitting an NPM package, so I'm genuinely curious how this works).
- delfinom 4y agoI guess the reason is to avoid punishing newbies for one that are doing baby's first NPM tutorials. The other problem is if you make a rule "reject npm packages with only a single file called README". The spam bots will just add another fake file. This is a race to the bottom and requires far more aggressive fighting.