In his talk, Feross mentioned that it would cost approximately 1 billion dollars to scan the entire npm ecosystem. They do it on demand for their customers IIRC. Try signing up and running their scans on it.
At a total cost of $1B that would put scanning a single package at $16/package? Nonsense. Even at $1 in compute time on aws that feels outlandishly high…
You can’t retroactively scan the package Socket missed. It was removed from npm. Scanning on demand means you’re going to miss critical relationships across threat groups, or across disparate but related packages.
As for the numbers: see 39 mins into https://youtu.be/jWujI7Hk8O4
I used to work at npm as the SRE manager right before the acquisition and the ballpark figures make sense to me.
Had a second to sit down, and I _way_ overestimated my counts.
Per NPM there are 2,480,373 packages. According to Whitesource [1] there are an average of 12.3 versions per package. This gives us a total of 30,508,587.9 archives to scan. At a cost of $1B to scan that means each package would cost $33.959…
There’s no way that’s reality. That seems like several orders of magnitude too high.
1. https://threatpost.com/malicious-npm-packages-web-apps/17813...