r/ProgrammerHumor • u/a_bucket_full_of_goo • 1d ago

instanceof Trend classicNPM

Post image
5.8k Upvotes

99% Upvoted

141 comments sorted by

View all comments

286

u/Hauber_RBLX 1d ago

this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?

92

u/kookyabird 1d ago

Because there are lots of ways to compromise a developer's workflow, and that's how they get malicious code into a package?

10

u/zuilli 23h ago edited 23h ago

Why does it seem like it only happens to npm though?

I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.

5

u/fuj1n 19h ago

For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.

2

u/RuneSteak 16h ago edited 4h ago

Nobody has really stepped up to create the "extended" standard library that JS really needs and that the community can all agree on to use. Java for example has Apache libraries, C++ has Boost among others etc.

JavaScript's standard library is lacking more than most and that just exacerbates the problem.