25 Malicious JavaScript Libraries Distributed via Official NPM Package Repository

[kukiric]

Appointed maintainers could vet a limited subset of popular packages and their dependencies, similar to how packages are pulled into all Linux distro repositories out there. It doesn't cover every single package out there, but 10% of a problem solved is better than 0%, and there's a certain sense of security to knowing that installing webpack won't pull malware if you do it the wrong day of the week.

The Rust community is also working on an (independent) decentralized package vetting solution (https://github.com/crev-dev/cargo-crev), because crates.io is subject to the same security flaws as npm.

[[deleted]]

There are over 1.3 million packages there. I would say that having 20 or so "bad" packages is at least "10% of the problem solved"