Hacker News Reader

There can be a lot of value in value in a code base such as this. Just copy an existing open source lib, add a small speed up, push for fast adoption across common OS build tools, now you can sell committer rights for a high price to anyone wanting to launch a supply chain attack. Could be very profitable.

This is of course unlikely to be ai’s motivation. I just wanted to present a count point to the argument that such modules have low value.

View on HN

Very true, this is a reason i'm trying to distance myself from the NPM ecosystem actually... It's a cultural problem as much as a technical one, and it is ripe for exploitation... In combination with some of the NPM CVEs revealed in the past, it's pretty scary the reach and potential a single NPM package has for destruction and exploitation... and that is before even considering packages that get included in front and back end code for the web.

Reply on news.ycombinator.com