3 ms·
As apposed to Google serving a typo-squatted malicious version of the package above the one you're looking for, directly from npm registry?
by joshmanders 4y ago
As apposed to Google serving a typo-squatted malicious version of the package above the one you're looking for, directly from npm registry?
- chatmasta 4y agoAt least when you get to that page you can see download metrics, etc that are not available on GitHub. That's not to say you don't have a point. It's kind of a damned if you do, damned if you don't situation with multiple underlying and partially conflicting causes (tyosquatting vs. SEO spam). IMO, the best solution to the SEO spam is for npm to increase the burden of automated signup. Add more CAPTCHAs or even phone verification. And trigger alerts when there are suddenly thousands of new signups, or thousands of packages pushed from one account. Also, they could add rel=nofollow to all links on the page. This would make it less of an attractive target for SEO spam (but not entirely, since the page itself might still rank highly and the spammer doesn't necessarily care about getting link juice out of it, so much as getting traffic to the npm page itself).