Top all-time · #9644
Ivan Akulov
Personal blog · iamakulov.com/noteswebprogramming
Ivan Akulov's personal blog at iamakulov.com covers web and programming. Since 2017, 8 different Hacker News readers have linked it 16 times, most often “Malicious NPM packages found and removed”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
Linked by one commenter in a debate on user scripts and browser extensions, as support for the point that unvetted npm packages and script registries are a hard security problem.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A front-end developer. React, Redux, architecture, CSS, design, text.
Most-linked posts?
- Malicious NPM packages found and removed5 people · 5 mentions · first linked 2017-08-01
- Analyzing the Walmart site performance2 people · 2 mentions · first linked 2018-04-30
- Webpack for real tasks: decreasing front-end size and improving caching2 people · 2 mentions · first linked 2017-05-10
- Exclusive code ownership (why it’s bad and what to do with it)2 people · 2 mentions · first linked 2017-01-23
What Hacker News says?
For everyone, here’s a one-liner to check your dependency tree: npm ls | grep -E "babelcli|crossenv|cross-env.js|d3.js|fabric-js|ffmepg|gruntcli|http-proxy.js|jquery.js|mariadb|mongose|mssql.js|mssql-node|mysqljs|nodecaffe|nodefabric|node-fabric|nodeffmpeg|nodemailer-js|nodemailer.js|nodemssql|node-opencv|node-opensl|node-openssl|noderequest|nodesass|nodesqlite|node-sqlite|node-tkinter|opencv.js|openssl.js|proxy.js|…
Comment linking /notes/npm-malicious-packages/
on “Malicious crossenv package on npm”Submitted Analyzing the Walmart site performance as a story · 96 points
HN discussion>The security benefit to consumers of blocking user scripts is probably a net positive for the average internet user. Strong disagree. Extensions and User scripts are an unmapped wild west. Providing a registry type system to securely vend packages/scripts is a very hard security problem. https://www.bleepingcomputer.com/news/security/mozilla-block... https://iamakulov.com/notes/npm-malicious-packages/
Comment linking /notes/npm-malicious-packages/
on “I miss the programmable web (2021)”Submitted Redux vs. React’s setState(): a simple criterion to choose between as a story · 4 points
HN discussionSubmitted Malicious NPM packages found and removed as a story · 2 points
HN discussionSubmitted Webpack for real tasks: decreasing front-end size and improving caching as a story · 2 points
HN discussionSubmitted Exclusive code ownership (why it’s bad and what to do with it) as a story · 2 points
HN discussionSubmitted Exclusive code ownership: why it’s bad and what to do with it as a story · 2 points
HN discussionSubmitted Case study: analyzing the Walmart site performance as a story · 1 points
HN discussionSubmitted Backend intro for frontend devs: Part 1, Node.js as a story · 1 points
HN discussionSubmitted Webpack examples for decreasing front-end size and improving caching as a story · 1 points
HN discussionSubmitted Designing APIs: use arrays instead of variable number of arguments as a story · 1 points
HN discussionSubmitted Malicious packages in npm. Here’s what to do as a story · 1 points
HN discussionSubmitted Malicious packages in npm as a story · 1 points
HN discussionSubmitted What webpack’s ContextReplacementPlugin actually does as a story · 1 points
HN discussionSubmitted Practical guide into webpack, part 1: bundling front-end and adding compilation as a story · 1 points
HN discussion