Hacker News Reader

This is a clever way to raise important issues in security of package managers, but I can't find support for your claim that NPM doesn't let you report malware. A cursory google search brought me this: https://docs.npmjs.com/reporting-malware-in-an-npm-package

And I confirmed that that button is indeed available on packages with a link that goes to eg https://www.npmjs.com/support?inquire=security&security-inqu...

What functionality was removed?

View on HN

When I went to report vulnerabilities in two packages, I got a prompt "are you the maintainer of this package?". I hit no and it told me to go inform the maintainer.

I'm not sure what to tell you. I submitted a report against your package and it went through and a security ticket was opened.

Could you post some screenshots of what you are seeing?

I suspect OP conflated "I am reporting malware in a package on npmjs.com" with "I have discovered a bug or vulnerability in a package on npmjs.com." The later shows what they report[0] whereas the former does allow for a report to be made.

[0] https://imgur.com/VSZbZ0Q

I'm also seeing a "Report malware" button directly on the package page

Reply on news.ycombinator.com