Hacker News new | ask | show | jobs
by Kiro 1693 days ago
What makes npm more insecure than other packaging systems?
2 comments

I would say that it's not that different from others I've seen, just more visible because of the size and activity of the repository.

One thing NPM does (and I believe Python too) is to allow install scripts -- this has been a reliable vector for attackers to steal credentials. Not every package repository system has that.

authors cannot revoke their compromised keys to immediately halt all distribution, and you don't have any process to verify package<->author ownership beyond the upload secrets.