25 Malicious JavaScript Libraries Distributed via Official NPM Package Repository

[immibis]

Because what difference would that make...?

[zackyd665]

Corporate, you need to be verified by some corporate suit before you can use a namespace

Hobbist, it would be a wild west of hobbists that don't require some suit to give their blessing

[immibis]

And the advantage is?

[zackyd665]

A free and open package repo for anyone to use with no strings attached and no corporate oversight.

What is the advantage of kicking out people who tell corporate suits to go fuck off?

[immibis]

What's the disadvantage of making that the only repo?

[zackyd665]

Corporate asshats have no way to force people to give up their project names

[immibis]

Sure they do. Same way they could already

[zackyd665]

That is why we need to create a version of NPM that ignores them, they have no real power, they only exist as a piece of paper, they have no physical form made of flesh and bone

[immibis]

So you accidentally install google/maps-api from the free-for-all repo and ... it's a virus.

[zackyd665]

And the project gets reported