Top all-time · #9990
blog.sandworm.dev
Company blog · blog.sandworm.devsecurityprogramming
blog.sandworm.dev is the company blog at blog.sandworm.dev, writing about security and programming. Since 2023, 8 different Hacker News readers have linked it 9 times, most often “Dissecting NPM Malware: Five Packages and Their Evil Install Scripts”. No feed was found, so read it on the site itself.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
Posts on npm malware and malicious install scripts. One commenter cites its finding that about half of new npm packages are SEO spam, and another comment discusses user base size and incentives for malicious packages.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Dissecting NPM Malware: Five Packages and Their Evil Install Scripts3 people · 3 mentions · first linked 2023-04-19
- 50% of new NPM packages are spam2 people · 2 mentions · first linked 2023-03-30
- The State of NPM 20232 people · 2 mentions · first linked 2023-07-12
What Hacker News says?
Remember, when we're triggered our reading comprehension goes down and we confuse emotion for facts. Did I say they ship more/less code? No, first I was talking about the user base size and the economic incentives for malicious users. For the most popular package: Debian: ~253K installs per month [1] NPM: ~236M installs per month [2] VSCode: ~158M installs total [3] Obviously VSCode is hard to compare, but the most…
Comment linking /state-of-npm-2023-the-overview
on “Material Theme has been pulled from VS Code's marketplace”Submitted 50% of new NPM packages are spam as a story · 8 points
HN discussionThe same well-known issues plague PyPI with setup.py. What I found perhaps more interesting is the Sandworm's finding that about a half of new npm packages are today SEO spam: https://blog.sandworm.dev/one-in-two-new-npm-packages-is-seo...
Comment linking /one-in-two-new-npm-packages-is-seo-spam-right-now
on “Dissecting NPM Malware: Five Packages and Their Evil Install Scripts”Submitted The Better NPM Audit as a story · 3 points
HN discussionSubmitted Dissecting NPM Malware: Five Packages and Their Evil Install Scripts as a story · 2 points
HN discussionSubmitted The State of NPM 2023 as a story · 1 points
HN discussionSubmitted The NPM packages that troll you as a story · 1 points
HN discussionSubmitted Dissecting NPM Malware: Five Packages and Their Evil Install Scripts as a story · 1 points
HN discussionSubmitted Dissecting NPM Malware: Five Packages and Their Evil Install Scripts as a story · 1 points
HN discussion
