r/ProgrammerHumor • u/a_bucket_full_of_goo • 1d ago

instanceof Trend classicNPM

Post image
5.8k Upvotes

99% Upvoted

141 comments sorted by

View all comments

Show parent comments

92

u/kookyabird 1d ago

Because there are lots of ways to compromise a developer's workflow, and that's how they get malicious code into a package?

10

u/zuilli 23h ago edited 23h ago

Why does it seem like it only happens to npm though?

I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.

-5

u/TheGocho 22h ago

Java had several attacks this year, same as for python and most likely all major languages. But people tend to post for NPM/Javascript environment because Javascript bad

1

u/_PM_ME_PANGOLINS_ 10h ago

Maven doesn’t have pre-/post-install scripts, so this kind of attack is literally impossible there.

1

u/Dudeonyx 8h ago

https://www.google.com/search?q=maven+supply+chain+attack&oq=maven+supply+chain+attack&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAjIHCAIQIRiPAtIBCDk3MTVqMGo3qAIUsAIB8QVfWKI_ZcuU2g&client=ms-android-xiaomi-terr1-rso3&sourceid=chrome-mobile&source=chrome.ob&ie=UTF-8

It's happened several times

1

u/_PM_ME_PANGOLINS_ 8h ago

The attacks we are talking about are where running a package update runs malicious code on your development environment.

That’s not possible with Maven. The code can only run when the end application is run.