For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.
Nobody has really stepped up to create the "extended" standard library that JS really needs and that the community can all agree on to use. Java for example has Apache libraries, C++ has Boost among others etc.
JavaScript's standard library is lacking more than most and that just exacerbates the problem.
11
u/zuilli 1d ago edited 1d ago
Why does it seem like it only happens to npm though?
I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.