this post was submitted on 22 Dec 2025
103 points (97.2% liked)

Technology

77873 readers
3371 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
103
NPM Package With 56K Downloads Caught Stealing WhatsApp Messages (www.koi.ai)
submitted 1 day ago by King@sh.itjust.works to c/technology@lemmy.world
20 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] wildbus8979@sh.itjust.works 2 points 19 hours ago (1 children)

I'm not super familiar with Maven so I could be wrong, but doesn't Maven still pull depencies from upstream? That doesn't fix the problem. Having depencies packaged in the OS means there is in theory some level of overview and review by the package maintainer(s).

[–] PushButton@lemmy.world 2 points 18 hours ago

There are two reasons. One is the name spacing that is inherent in Maven and bolted on to npm, and the enforcement or lack of enforcement in the repository. You can read more about that here https://blog.sonatype.com/why-namespacing-matters-in-public-open-source-repositories Then there’s the fact that npm runs “install” scripts when you download the component. This means if you can trick someone into grabbing your component by namespace confusion, typosquatting a name etc, you can get code run as soon as someone makes a mistake. Maven on the other hand only downloads the jars, it does not execute them. Taken together, you have an easier path to tricking people to grabbing your component with npm and that trick leads directly to code execution.

—Brian Fox, Apache Maven PM & Sonatype cofounder & CTO

I am on my phone, which is a bit too long to explain, but there are multiple facets to how NPM is worse than most packaging systems out there. There are enough on the web for you to browse and learn, if you are really interested to know more.

But, here, I quoted a little something from Brian from Sonatype.