NPM is the most popular, so it happens the most frequently. All of the other eco... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		SkyPuncher 4 months ago \| parent \| context \| favorite \| on: Shai-Hulud malware attack: Tinycolor and over 40 N... NPM is the most popular, so it happens the most frequently. All of the other ecosystems are just as susceptible. Unix had a big scare last year because of XZ Utils. https://en.wikipedia.org/wiki/XZ_Utils_backdoor

Sankozi 4 months ago [–]

No they are not as susceptible - auto updating dependencies, post install scripts and culture of thousands of crappy micro packages (like left-pad) is mainly a NPM issue.

zachrip 4 months ago | [–]

Packages are not auto updated if you have a package-lock. Agreed that post-install, left-pad, etc have been overall problematic tho.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact