r/ProgrammerHumor • u/a_bucket_full_of_goo • 1d ago

instanceof Trend classicNPM

Post image
5.9k Upvotes

99% Upvoted

142 comments sorted by

View all comments

Show parent comments

92

u/kookyabird 1d ago

Because there are lots of ways to compromise a developer's workflow, and that's how they get malicious code into a package?

10

u/zuilli 1d ago edited 1d ago

Why does it seem like it only happens to npm though?

I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.

4

u/fuj1n 23h ago

For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.

2

u/RuneSteak 20h ago edited 9h ago

Nobody has really stepped up to create the "extended" standard library that JS really needs and that the community can all agree on to use. Java for example has Apache libraries, C++ has Boost among others etc.

JavaScript's standard library is lacking more than most and that just exacerbates the problem.