3 ms·

What’s the chance Phylum created those packages?

• fnord77 3y ago
  the article author does seem overly gleeful about it
• thenerdhead 3y ago
  Definitely not zero. Security researchers and SSC companies are pretty notorious for self-promotion. I would not be surprised if some of these "detected packages" are from researchers who want attention.
  • louislang 3y ago
    You're not wrong. We (Phylum) have seen and called out a security company for typosquatting a popular package as a means of advertising. It felt gross to impact random devs for marketing...
• louislang 3y ago
  Full disclosure: I'm one of the co-founders of Phylum. I can absolutely assure you, we have no affiliation with these packages. We end up reporting much more malicious packages than these every single day. We wouldn't risk harming our reputation to publish three dumb packages. Just thought these were interesting in a diabolical sort of way.