Posted by sohkamyung 12/22/2025
Why aren't more teams putting some tool in-front of their blind-installs from NPM (et al)
It’s hard to read any blog anymore without trying to work out which part is actually from a human.
But then, you'd only be sure that the first sentence was legitimate and not the rest of the article. That is why I constantly reassure my readers that they're some goddamn motherfuckers throughout my writing. And you, too, are one, my friend.
I assume the answer is no because this is clearly clickbait AI slop but who knows.
The language is too hard to do a meaningful static analysis. This particular attack is much harder (though not impossible) to execute in Java, Go, or Rust-based packages.
True. In a backend, however, a compromised payload can put all of user's and your non-user data at risk.
That sounds like a GDPR fine waiting to be issued right there.
It is not harder to write. It is more challenging to execute this attack stealthily.
Due to the myriad behaviors of runtimes (browser vs. backend), frameworks (and their numerous versions), and over-dependency on external dependencies (e.g., leftpad), the risk in JS-based backends increases significantly.