3 ms·
Once again, Shai-Hulud wrecking havock in the Javascript and Typescript ecosystems via NPM. One of the worst ecosystems that has been brought into the software
by rvz 6mo ago
Once again, Shai-Hulud wrecking havock in the Javascript and Typescript ecosystems via NPM.
One of the worst ecosystems that has been brought into the software industry and it is almost always via NPM. Not even Cargo (Rust) or go mod (Golang) get as many attacks because at least with the latter, they encourage you to use the standard library.
Both Javascript and Typescript have none and want you to import hundreds of libraries, increasing the risk of a supply chain attack.
At this point, JS and TS are considered harmful.
- squidsoup 6mo agoIf cargo was as popular as npm, the same issues would surface.
- ric2b 6mo agoNo, because Rust has a standard library that covers the basics enough to not push you to start adding decencies as quickly.
- skydhash 6mo agoThe Standard C library is also very small. Even though there’s POSIX, for anything that’s not system programming, you will be using libraries. The difference is that the usual C libraries don’t split the project into small molecules for no good reasons. You have to be as big as GTK to start splitting library in my opinion.
- robertjpayne 6mo agoI don't really buy this. NPM is targeted because it's the largest attack surface with the biggest payoff for a successful attack. Other ecosystems package managers are really no different in a lot of ways. NPM's biggest fault is just it allows post/pre install scripts by default without user intervention.
- ric2b 6mo agoYour last two sentences are contradictory. That is a very significant difference. Another significant difference is how useful the standard library of each language is, so that you can avoid 3rd party libraries. Also the tendency in the JS ecosystem to break libraries into tiny parts, because it helps or historically helped to ship less code to the user.
- AlotOfReading 6mo agoI wonder whether NPM has surpassed the costs of the billion dollar mistake, null references. NPM hasn't been around as long, but the industry is much bigger today than it was when systems languages were dominant.
- silverwind 6mo agoPython had these too, no ecosystem is safe.
- pier25 6mo ago> Both Javascript and Typescript have none and want you to import hundreds of libraries There are plenty of very popular packages with zero dependencies like Hono or Zod. If you decide to blindly install something with hundreds of deps it's on you. That said, I do agree the JS standard library should provide a lot more than it does now.
- devilsdata 6mo agoLook I love Rust and hate Typescript. But if NPM didn't exist, wouldn't the attackers just hit the next most popular supply chain? Cargo isn't immune to this, as much as I love Rust and wish more shops used it.
- febusravenga 6mo agoIt's not failure of npm/js ecosystem. It's Github Actions failure that allowed this to happen.