[nodesocket]

While Python being more widely used than JS, it's interesting the majority of attacks and breaches come from NPM. The consensus seems to be that Python offering a standard library greatly reduces the attack surface over JS. I tend to agree with this, a decently large Flask python app I am working on has 15 entries in requirements.txt (many of which being Flask plugins).

[magnio]

https://www.sonatype.com/blog/pytorch-namespace-dependency-c...

https://socket.dev/blog/pypi-package-disguised-as-instagram-...

https://socket.dev/blog/monkey-patched-pypi-packages-steal-s...

https://socket.dev/blog/malicious-pypi-package-targets-disco...

https://socket.dev/blog/typosquatting-on-pypi-malicious-pack...

[zahlman]

The most important packages in the Python world don't have a lot of their own dependencies. Numpy has none, for example. The bulk of Numpy is non-Python code and interfaces/wrappers for that; the standard library isn't AFAIK pulling a whole lot of weight there.

[nwellnhof]

Numpy depends on BLAS and LAPACK.

[milkshakes]

while those are obviously huge dependencies, i think the claim was about _python_ dependencies

[kinow]

I also think the same. While in Java the stdlib lacks a few functions, long ago Apache Commons became the de-facto complement for the Java stdlib, being replaced/complemented by other libs over time, and eventually even becoming obsolete with newer versions of Java. But I always had the impression that having Apache Software Foundation components (with a good release/security process) helped Java to mitigate a lot of attacks.

[o11c]

Javascript is also hindered by the fact that you have to "pay" for every library you download. This encourages a culture of reinventing the wheel, because "I don't need all that," preventing de-factor stdlib supplements from existing.

[Hasnep]

The large attack surface with npm is partly because of all the transitive dependencies used, which means that even if you only pull in a dozen packages directly, you're also using hundreds of other packages. Running `pip freeze` will list a lot of transitive dependencies as well, but I'm sure it'll be less than an equivalent JS project.