this post was submitted on 22 Dec 2025
88 points (96.8% liked)

Technology

77873 readers
4861 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
88
NPM Package With 56K Downloads Caught Stealing WhatsApp Messages (www.koi.ai)
submitted 15 hours ago by King@sh.itjust.works to c/technology@lemmy.world
19 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] PushButton@lemmy.world 1 points 8 hours ago* (last edited 8 hours ago) (1 children)

This isn't going to get any better unless we revert to OS based dependencies which noone wants to do because developers want the latest and greatest model.

Maven entered the room.

[–] wildbus8979@sh.itjust.works 2 points 8 hours ago (1 children)

I'm not super familiar with Maven so I could be wrong, but doesn't Maven still pull depencies from upstream? That doesn't fix the problem. Having depencies packaged in the OS means there is in theory some level of overview and review by the package maintainer(s).

[–] PushButton@lemmy.world 1 points 8 hours ago

There are two reasons. One is the name spacing that is inherent in Maven and bolted on to npm, and the enforcement or lack of enforcement in the repository. You can read more about that here https://blog.sonatype.com/why-namespacing-matters-in-public-open-source-repositories Then there’s the fact that npm runs “install” scripts when you download the component. This means if you can trick someone into grabbing your component by namespace confusion, typosquatting a name etc, you can get code run as soon as someone makes a mistake. Maven on the other hand only downloads the jars, it does not execute them. Taken together, you have an easier path to tricking people to grabbing your component with npm and that trick leads directly to code execution.

—Brian Fox, Apache Maven PM & Sonatype cofounder & CTO

I am on my phone, which is a bit too long to explain, but there are multiple facets to how NPM is worse than most packaging systems out there. There are enough on the web for you to browse and learn, if you are really interested to know more.

But, here, I quoted a little something from Brian from Sonatype.