Hacker News Reader

I always wonder how many of these are just bought by shady companies to install spyware and such. Seems like something easy to duplicate for anyone with funds. Unless they aren't in the business of building and running apps. I know at least a few this has happened to and goes on in the Google play store as well.

View on HN

A lot of SEO spammers buy old but popular Wordpress plugins to inject hidden backlinks to their websites, so it's entirely possible

Woah, didn't know that, that's low.

Would it be feasible for an SEO spammer to covertly include such backlinks in an npm package update?

Check the backlink profile for pages ranking for spam-dominated queries such as "buy CBD oil" or "buy viagra" and you'll see an incredible amount of spam and fraud.

Sucks that despite this being a 20+ year old problem, Google hasn't been able to fix it.

If 'npm package update' includes the ability to modify strings in served pages, one would assume so.

Reply on news.ycombinator.com