4 ms·

NPM, why am I not surprised... and this broadly applies to the JS ecosystem. When people delegate their brains to others, their own judgment naturally deterior

NPM, why am I not surprised... and this broadly applies to the JS ecosystem. When people delegate their brains to others, their own judgment naturally deteriorates and it makes them much easier to fool.

nailer 2y ago
JS/TS having code reusability isn't a problem. Other ecosystems don't have the same problems not because they have package repos just as good as npm but write everything from scratch out of virtue, but because they don't have package repos just as good as npm.
- sigzero 2y ago
  > because they don't have package repos just as good as npm What? That simply is not true unless you mean "good" as in "good in spreading malware". lol
  - paulddraper 2y ago
    "Easy to use" being more descriptive. Which is a help for spreading both good code and malware.
  - bolognafairy 2y ago
    I’d be curious to hear what you think that PyPI et al are doing that NPM should be copying. It sounds like you’re pretty knowledgeable in this area, to be comfortable making comments like this with such confidence.
  - nailer 2y ago
    I would respond, but you have not provided any supporting arguments.
twelve40 2y ago
how um is this different from pypi or public repos in other languages... you could try to publish junk anywhere
- recursive 2y ago
  In node projects, having more dependencies is usually seen as an asset, not a liability. Other than that, I don't think there's a difference. When I write node projects, I tend to minimize dependencies, but I've seen PR comments saying "you know you could just get a package to do that".
  - cluckindan 2y ago
    ”Usually”? Do you have some statistics on that, or do you just feel that way?
    - recursive 2y ago
      Just feel that way. That's my anecdotal observation. YMMV.
    - wswope 2y ago
      [Misread, mb - ty @Jarwain]
      - Jarwain 2y ago
        You may have mixed up who the commenter was replying to. They were specifically questioning "usually seen as an asset not a liability" bit
        bolognafairy 2y ago
        That’s really all there is in the comment. They’re unambiguously conflating “number of dependencies are higher” with some sort of statement about the value system of people that work with a certain language. It’s silly language tribalism.
  - Fauntleroy 2y ago
    This is an extremely weird thing to say. I don't know a single node dev who wants more dependencies. Anyone with a modicum of experience in the space knows the cost of bringing in more external code.
diggan 2y ago
> When people delegate their brains to others, their own judgment naturally deteriorates and it makes them much easier to fool A thought as old as thoughts about thoughts are, almost: > For this invention will produce forgetfulness in the minds of those who learn to use it, because they will not practice their memory. Their trust in writing, produced by external characters which are no part of themselves, will discourage the use of their own memory within them. You have invented an elixir not of memory, but of reminding; and you offer your pupils the appearance of wisdom, not true wisdom, for they will read many things without instruction and will therefore seem to know many things, when they are for the most part ignorant and hard to get along with, since they are not wise, but only appear wise. The quote above is about books, from Plato's dialogue Phaedrus 14 (370-360 BCE). You by any chance feel the same about books as you feel about reusable JavaScript modules published on npm?
- lm28469 2y ago
  This plato's quote about books is too often used as something like: "someone smart was wrong about something once, hence everyone is wrong about every new thing forever" Nothing is black nor white but npm brought its fair share of dumb shit: https://en.m.wikipedia.org/wiki/Npm_left-pad_incident https://en.m.wikipedia.org/wiki/Npm_left-pad_incident
  - diggan 2y ago
    > This plato's quote about books is too often used as something like: "someone smart was wrong about something once, hence everyone is wrong about every new thing forever" I mean, it is fairly similar to what parent actually wrote, isn't it a relevant quote in the context? You're not actually arguing for one way or another, but simply because you've seen the quote multiple times before, it doesn't apply, or what are you trying to say? How is the left_pad incident related to developers becoming easier to fool?
    - seanthemon 2y ago
      There should be a quote for that
filoeleven 2y ago
I found it even more unsurprising that the fake extension targeted some crypto thing. > it has the same description as the original truffle extension: “Build, debug and deploy smart contracts on EVM-compatible blockchains.”
paulddraper 2y ago
> why am I not surprised Because VSCode and npm are popular. It’s not like Ruby gems are immune to this. They just aren’t as popular.
j-bos 2y ago
For variety, here's an example from the Go ecosystem: https://arstechnica.com/security/2025/02/backdoored-package-in-go-mirror-site-went-unnoticed-for-3-years/ https://arstechnica.com/security/2025/02/backdoored-package-...
dawnerd 2y ago
I definitely feel like NPM could be doing more to detect these. Right now it really feels like they're just hands off.
bolognafairy 2y ago
This is an ironic statement, right? Because you’re mindlessly parroting a copy of a copy of what was once, probably, an intelligent and appropriately nuanced take? And because you’re attributing this to the “JS ecosystem” when supply chain attacks are common in many different ecosystems? LLM-ass comment.
- elaus 2y ago
  Worst of all: the article never explains what npm has to do with it. Vscode extensions are not installed via npm, so at least part of the malware depends on the Vscode extension store.
ajross 2y ago
> When people delegate their brains to others I dunno, Linux distros have a pretty good track record at the same problem, over multiple decades of evidence. The difference is that they don't allow self-publication. Canonical and Red Hat et. al. work downstream of an active community of developers cross-attesting good software. So their problem becomes "This software is known to be good, let's package it!". So to get malware into the machines of users it's not enough to fool the users, you need to fool the packagers too. And it happens, but very rarely (c.f. the xzutils mess from last year). Node and similar repositories thought they could short-circuit that process, and as has been extensively documented, it doesn't work because users are too lazy to authenticate their own software.
deleted 2y ago
[deleted]
lolinder 2y ago
Is this even related to npm? The extension was on the VS Code marketplace, I can't see any evidence that npm is involved at all besides that it's referenced in passing exactly once in the article: > the need for caution when installing VS Code extensions, especially those obtained from public package registries like npm. I'm not aware of any way to install a VS Code extension through NPM. The article honestly just reads like the author knew that Mend does a lot of business selling NPM dependency scanning and that they're therefore expected to stuff it as a keyword for SEO.

nailer 2y ago

JS/TS having code reusability isn't a problem. Other ecosystems don't have the same problems not because they have package repos just as good as npm but write everything from scratch out of virtue, but because they don't have package repos just as good as npm.

sigzero 2y ago
> because they don't have package repos just as good as npm What? That simply is not true unless you mean "good" as in "good in spreading malware". lol
- paulddraper 2y ago
  "Easy to use" being more descriptive. Which is a help for spreading both good code and malware.
- bolognafairy 2y ago
  I’d be curious to hear what you think that PyPI et al are doing that NPM should be copying. It sounds like you’re pretty knowledgeable in this area, to be comfortable making comments like this with such confidence.
- nailer 2y ago
  I would respond, but you have not provided any supporting arguments.

twelve40 2y ago

how um is this different from pypi or public repos in other languages... you could try to publish junk anywhere

recursive 2y ago
In node projects, having more dependencies is usually seen as an asset, not a liability. Other than that, I don't think there's a difference. When I write node projects, I tend to minimize dependencies, but I've seen PR comments saying "you know you could just get a package to do that".
- cluckindan 2y ago
  ”Usually”? Do you have some statistics on that, or do you just feel that way?
  - recursive 2y ago
    Just feel that way. That's my anecdotal observation. YMMV.
  - wswope 2y ago
    [Misread, mb - ty @Jarwain]
    - Jarwain 2y ago
      You may have mixed up who the commenter was replying to. They were specifically questioning "usually seen as an asset not a liability" bit
      - bolognafairy 2y ago
        That’s really all there is in the comment. They’re unambiguously conflating “number of dependencies are higher” with some sort of statement about the value system of people that work with a certain language. It’s silly language tribalism.
- Fauntleroy 2y ago
  This is an extremely weird thing to say. I don't know a single node dev who wants more dependencies. Anyone with a modicum of experience in the space knows the cost of bringing in more external code.

diggan 2y ago

> When people delegate their brains to others, their own judgment naturally deteriorates and it makes them much easier to fool A thought as old as thoughts about thoughts are, almost: > For this invention will produce forgetfulness in the minds of those who learn to use it, because they will not practice their memory. Their trust in writing, produced by external characters which are no part of themselves, will discourage the use of their own memory within them. You have invented an elixir not of memory, but of reminding; and you offer your pupils the appearance of wisdom, not true wisdom, for they will read many things without instruction and will therefore seem to know many things, when they are for the most part ignorant and hard to get along with, since they are not wise, but only appear wise. The quote above is about books, from Plato's dialogue Phaedrus 14 (370-360 BCE). You by any chance feel the same about books as you feel about reusable JavaScript modules published on npm?

lm28469 2y ago
This plato's quote about books is too often used as something like: "someone smart was wrong about something once, hence everyone is wrong about every new thing forever" Nothing is black nor white but npm brought its fair share of dumb shit: https://en.m.wikipedia.org/wiki/Npm_left-pad_incident https://en.m.wikipedia.org/wiki/Npm_left-pad_incident
- diggan 2y ago
  > This plato's quote about books is too often used as something like: "someone smart was wrong about something once, hence everyone is wrong about every new thing forever" I mean, it is fairly similar to what parent actually wrote, isn't it a relevant quote in the context? You're not actually arguing for one way or another, but simply because you've seen the quote multiple times before, it doesn't apply, or what are you trying to say? How is the left_pad incident related to developers becoming easier to fool?
  - seanthemon 2y ago
    There should be a quote for that

filoeleven 2y ago

I found it even more unsurprising that the fake extension targeted some crypto thing. > it has the same description as the original truffle extension: “Build, debug and deploy smart contracts on EVM-compatible blockchains.”

paulddraper 2y ago

> why am I not surprised Because VSCode and npm are popular. It’s not like Ruby gems are immune to this. They just aren’t as popular.

j-bos 2y ago

For variety, here's an example from the Go ecosystem: https://arstechnica.com/security/2025/02/backdoored-package-in-go-mirror-site-went-unnoticed-for-3-years/ https://arstechnica.com/security/2025/02/backdoored-package-...

dawnerd 2y ago

I definitely feel like NPM could be doing more to detect these. Right now it really feels like they're just hands off.

bolognafairy 2y ago

This is an ironic statement, right? Because you’re mindlessly parroting a copy of a copy of what was once, probably, an intelligent and appropriately nuanced take? And because you’re attributing this to the “JS ecosystem” when supply chain attacks are common in many different ecosystems? LLM-ass comment.

elaus 2y ago
Worst of all: the article never explains what npm has to do with it. Vscode extensions are not installed via npm, so at least part of the malware depends on the Vscode extension store.

ajross 2y ago

> When people delegate their brains to others I dunno, Linux distros have a pretty good track record at the same problem, over multiple decades of evidence. The difference is that they don't allow self-publication. Canonical and Red Hat et. al. work downstream of an active community of developers cross-attesting good software. So their problem becomes "This software is known to be good, let's package it!". So to get malware into the machines of users it's not enough to fool the users, you need to fool the packagers too. And it happens, but very rarely (c.f. the xzutils mess from last year). Node and similar repositories thought they could short-circuit that process, and as has been extensively documented, it doesn't work because users are too lazy to authenticate their own software.

deleted 2y ago

[deleted]

lolinder 2y ago

Is this even related to npm? The extension was on the VS Code marketplace, I can't see any evidence that npm is involved at all besides that it's referenced in passing exactly once in the article: > the need for caution when installing VS Code extensions, especially those obtained from public package registries like npm. I'm not aware of any way to install a VS Code extension through NPM. The article honestly just reads like the author knew that Mend does a lot of business selling NPM dependency scanning and that they're therefore expected to stuff it as a keyword for SEO.