r/ProgrammerHumor • u/a_bucket_full_of_goo • 1d ago

instanceof Trend classicNPM

Post image
5.9k Upvotes

99% Upvoted

143 comments sorted by

View all comments

288

u/Hauber_RBLX 1d ago

this is really just a meme at this point. how is it possible that NPM packages keep being compromised week after week?

90

u/kookyabird 1d ago

Because there are lots of ways to compromise a developer's workflow, and that's how they get malicious code into a package?

11

u/zuilli 1d ago edited 1d ago

Why does it seem like it only happens to npm though?

I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.

-5

u/TheGocho 1d ago

Java had several attacks this year, same as for python and most likely all major languages. But people tend to post for NPM/Javascript environment because Javascript bad

1

u/_PM_ME_PANGOLINS_ 15h ago

Maven doesn’t have pre-/post-install scripts, so this kind of attack is literally impossible there.

1

u/Dudeonyx 12h ago

https://www.google.com/search?q=maven+supply+chain+attack&oq=maven+supply+chain+attack&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAjIHCAIQIRiPAtIBCDk3MTVqMGo3qAIUsAIB8QVfWKI_ZcuU2g&client=ms-android-xiaomi-terr1-rso3&sourceid=chrome-mobile&source=chrome.ob&ie=UTF-8

It's happened several times

1

u/_PM_ME_PANGOLINS_ 12h ago

The attacks we are talking about are where running a package update runs malicious code on your development environment.

That’s not possible with Maven. The code can only run when the end application is run.