←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0s | source
Show context
nromiun ◴[08 Sep 25 16:19 UTC] No.45170180[source]▶
I have nothing to do with this but still I am getting second hand embarrassment. Here is an example, is-arrayish package, 73.8 MILLION downloads per week. The code? 3 lines to check if an object can be used like an array.

I am sorry, but this is not due to not having a good standard library, this is just bad programming. Just pure laziness. At this point just blacklist every package starting with is-.

replies(5): >>45170288 #>>45170925 #>>45172151 #>>45173397 #>>45175092 #
zahlman ◴[08 Sep 25 16:27 UTC] No.45170288[source]▶
Meanwhile in Python: 134 million weekly downloads, seemingly slowly trending upward over time, for https://pypistats.org/packages/six which provides third-party compatibility for a version of Python that dropped support over five years ago.
replies(3): >>45170340 #>>45172271 #>>45175962 #
sega_sai ◴[08 Sep 25 18:54 UTC] No.45172271[source]▶
Most of these downloads, I would bet, are from CI
replies(1): >>45173642 #
1. zahlman ◴[08 Sep 25 20:36 UTC] No.45173642[source]▶
Oh, I don't doubt it at all. But that doesn't make it any less depressing to me. Nor does it matter to Fastly's bandwidth burden.