Hacker News Reader

It's an attractive target. Other ecosystems (maybe besides Rust) rely on large packages with minimal dependencies, and those packages are often first-party (Entity Framework, for example).

NPM meanwhile is a neverending net of tiny oneliner packages, required by other oneliner packages, required by twoliner packages, required by single-function packages, required by... required by React. And thus, adding malware to `is-number` adds it to all 8766235452 packages that depend on it.

I thought someone happened in pip the other year.

Part of the NPM issue is that everything gets atomized into tiny libraries and no one seems to care about the dependency explosion.

The older such a system is, the more there is a "don't trust anyone" mentality. Some decades in the past you did not just run alien code in your system.

Edit: without looking at it beforehand

There definitely is malware around on PyPI, and typosquatting.