4 ms·

Because of course it’s npm

by moi2388 5mo ago

type0 5mo ago
Does npm stand for "newly packaged malware"?
- wolfi1 5mo ago
  should be a meme
- Ygg2 5mo ago
  Akshully, "Node Packaged Malware."
  - thrownthatway 5mo ago
    Needs more recursion. NPM - NPM Packaged Malware
matheusmoreira 5mo ago
Every programming language package manager is affected. Any random person can sign up and push packages. They are all equivalent to the Arch Linux User Repository and have the exact same caveats.
- grey-area 5mo ago
  I last added a new dependency to a large project I work on a couple of years ago. So no, not all ecosystems are the same. The culture makes a difference.
- stephenr 5mo ago
  How many other languages of any kind have a standard library that is so bizarrely lacking as JS? Now how many other mainstream languages of any kind have a standard library that is so lacking? Now how many other mainstream languages have a swathe of front-end developers that suddenly realised they can run code in a CLI or on a server, and spent exactly 0 minutes learning about how to make it not shit? Now how many other languages get used in scenarios where it makes absolutely zero sense because the developer only knows javascript?
  - matheusmoreira 5mo ago
    This has nothing to do with standard libraries or popularity. It's about trust. I signed up for an npm account and pushed packages. Same for PyPI. Same for Ruby gems. There's no actual reason why anyone should believe I pushed anything but malware in there.
    - stephenr 5mo ago
      Did you not read point 3? Developer experience level is a part of the problem.
      - matheusmoreira 5mo ago
        Yes, and it makes no sense. It's not a "swathe of front-end developers" problem. Developers in general want to push packages. They don't want to experience friction while doing it. They especially don't want to have to do things like engage with Linux distribution maintainers in order to get their packages into official software repositories. They want to just run $pkgr publish on their repo and that's it. So they invariably end up creating their own distribution mechanisms with zero maintainers involved. Just untrusted randoms making accounts and pushing random stuff. It's easy, so naturally what happens is the repositories get filled with software. It's only natural to use the stuff that is out there, so the packages get added to projects as dependencies despite the fact none of it is even slightly trusted. Developers hate friction when using libraries too. They very much want to just run $pkgr install x on their repositories and be done with it. They don't want to do things like read the source code or verify that it actually corresponds to what they've downloaded. That's somebody else's problem. On Linux distrubutions, that somebody else is the package maintainer, the exact person the programming language package managers aim to eliminate.
        stephenr 5mo ago
        > It's only natural to use the stuff that is out there Sure, if your entire "community" lives and dies by a nonsensical "don't reinvent the wheel, there is a package for that" chant that would rival the most fervent cult members.

Because of course it’s npm

by moi2388 5mo ago

Because of course it’s npm

type0 5mo ago

Does npm stand for "newly packaged malware"?

wolfi1 5mo ago
should be a meme
Ygg2 5mo ago
Akshully, "Node Packaged Malware."
- thrownthatway 5mo ago
  Needs more recursion. NPM - NPM Packaged Malware

matheusmoreira 5mo ago

Every programming language package manager is affected. Any random person can sign up and push packages. They are all equivalent to the Arch Linux User Repository and have the exact same caveats.

grey-area 5mo ago
I last added a new dependency to a large project I work on a couple of years ago. So no, not all ecosystems are the same. The culture makes a difference.
stephenr 5mo ago
How many other languages of any kind have a standard library that is so bizarrely lacking as JS? Now how many other mainstream languages of any kind have a standard library that is so lacking? Now how many other mainstream languages have a swathe of front-end developers that suddenly realised they can run code in a CLI or on a server, and spent exactly 0 minutes learning about how to make it not shit? Now how many other languages get used in scenarios where it makes absolutely zero sense because the developer only knows javascript?
- matheusmoreira 5mo ago
  This has nothing to do with standard libraries or popularity. It's about trust. I signed up for an npm account and pushed packages. Same for PyPI. Same for Ruby gems. There's no actual reason why anyone should believe I pushed anything but malware in there.
  - stephenr 5mo ago
    Did you not read point 3? Developer experience level is a part of the problem.
    - matheusmoreira 5mo ago
      Yes, and it makes no sense. It's not a "swathe of front-end developers" problem. Developers in general want to push packages. They don't want to experience friction while doing it. They especially don't want to have to do things like engage with Linux distribution maintainers in order to get their packages into official software repositories. They want to just run $pkgr publish on their repo and that's it. So they invariably end up creating their own distribution mechanisms with zero maintainers involved. Just untrusted randoms making accounts and pushing random stuff. It's easy, so naturally what happens is the repositories get filled with software. It's only natural to use the stuff that is out there, so the packages get added to projects as dependencies despite the fact none of it is even slightly trusted. Developers hate friction when using libraries too. They very much want to just run $pkgr install x on their repositories and be done with it. They don't want to do things like read the source code or verify that it actually corresponds to what they've downloaded. That's somebody else's problem. On Linux distrubutions, that somebody else is the package maintainer, the exact person the programming language package managers aim to eliminate.
      - stephenr 5mo ago
        > It's only natural to use the stuff that is out there Sure, if your entire "community" lives and dies by a nonsensical "don't reinvent the wheel, there is a package for that" chant that would rival the most fervent cult members.