Hacker News Reader

Comment by jannes | Hacker News Reader

Who would actually use these packages? The README files are empty and the packages don't export anything. I don't see anyone using these by accident.

I guess its meant to play a sick joke on some co-workers?

https://www.npmjs.com/package/lodash-simple

https://www.npmjs.com/package/lodash_tailwind

View on HN

I think the next step is creating a PR to another, higher profile package introducing a problematic dependency among other changes. It existing on its own doesn't prove intention of doing that, but it enables it. If I were doing this I'd start by creating an actually useful package and then later change it's behavior, but same principle.

If you were just trying to get people to install it directly you'd go for name collisions / typos / namesquatting in your package name instead.

The trick is to change the package-lock.

What you do it fork a popular package that the project uses and make some changes.

Then update the package-lock so that it points to your GitHub fork.

This file is normally ignored in PR due to the amount of line changes in there so you can have quite a bit of fun.

We‘ve been writing a tool to check lock files against the registry: https://www.npmjs.com/package/@gitlab/untamper-my-lockfile

For now it only supports yarn, but npm support shouldn’t be too hard.

This is really cool work, glad to see someone tackling this! Can I assume this will get rolled out into gitlab natively?

Actually good point, will talk to the respective PMs next week. Mainly been using it in CI in order to protect our own projects (thus yarn only for now)

I’ll never understand blog posts like these. I feel like I could make an npm package called “lodash-extra-turbo” that does nothing but shell out to call “rm -rf” and someone will write a blog post about how this evil npm package by a scary hacker will wipe your system.

As suggested in the current top comment it could even be you who writes the blog post as well.

We've seen a handful of individuals just go to PyPi or NPM and search for _something_ loosely related to what they need, and just blindly install it. I got a report yesterday of someone that did this with a Python package; similar setup: loosely related name, no README... guy still ran it.

I think there is small but non-zero chance that someone might do it, and that's enough. Can easily happen if you were not paying attention when looking for a lodash in npmjs.com, or using the autocomplete on vscode, codesandbox that don't provide more context anyway.

They could also write tutorial or stackoverflow answers linking those packages, it would definitely pass the moderation as the rest of the code would be okay and people copy/paste a lot.

Or maybe they are just assessing what's possible. (or wrote for this article)

That or someone wrote them just for this blog post...

They're apparently named after a couple of popular actual npm packages, lodash and tailwindcss. So I guess it's possible some people will try these out as the "simple" version of lodash, or as the version that is meant to work with tailwindcss?

Reply on news.ycombinator.com