Is this our chance to stop using NPM? [LWN.net]

Is this our chance to stop using NPM?

Posted Jun 1, 2026 15:48 UTC (Mon) by yodermk (guest, #3803)
In reply to: Is this our chance to stop using NPM? by jpeisach
Parent article: Multiple redhat-cloud-services npm packages compromised (StepSecurity Blog)

Yeah, but this can be an issue with pretty much any language package repo. It's kind of a real problem, and maybe borderline insane to install the latest stuff from there on any computer with important data. Maybe a best practice is to install the latest version that has been out longer than, say, 2 months?

Is this our chance to stop using NPM?

Posted Jun 1, 2026 18:07 UTC (Mon) by ibukanov (subscriber, #3942) [Link]

It was specifically JS that ended up with huge number of tiny packages vastly increasing the chance of compromise. I do not think it was just language popularity but specifically language features like tiny standard library and the way external modules are loaded that lead to this. Plus NPM made it too easy in retrospect to create and submit a package.