←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0.001s | source
Show context
stathibus ◴[08 Sep 25 16:00 UTC] No.45169926[source]▶
As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?
replies(11): >>45169990 #>>45169999 #>>45170008 #>>45170014 #>>45170015 #>>45170016 #>>45170038 #>>45170063 #>>45170879 #>>45170926 #>>45170953 #
dist-epoch ◴[08 Sep 25 16:08 UTC] No.45170015[source]▶
This is spreading everywhere, Rust, Python, ...
replies(3): >>45170086 #>>45170495 #>>45171565 #
grishka ◴[08 Sep 25 16:13 UTC] No.45170086[source]▶
Not Java, thankfully! Libraries containing 1-2 trivial classes do exist, but they're an exception rather than a rule. Might be that the process of publishing to Maven Central is just convoluted enough to deter the kinds of people who would publish such libraries.
replies(1): >>45170299 #
Deukhoofd ◴[08 Sep 25 16:28 UTC] No.45170299[source]▶
Also because Java, .NET, etc. all have very expansive standard libraries. You don't need to import most stuff, as it's already built-in.
replies(3): >>45170367 #>>45170379 #>>45171180 #
1. tracker1 ◴[08 Sep 25 16:33 UTC] No.45170367{3}[source]▶
Very true... I'm more experienced with .Net, but usually when you bring in something, it's much more of a compositional library or framework for doing something... like a testing harness (XUnit), web framework (FastEndpoints), etc. No so much in terms of basic utilities, where the std library and extensions for LINQ cover a lot of ground, even if you aren't using LINQ expressions themselves.