Hacker News Reader

A lot of SEO spammers buy old but popular Wordpress plugins to inject hidden backlinks to their websites, so it's entirely possible

View on HN

Woah, didn't know that, that's low.

Would it be feasible for an SEO spammer to covertly include such backlinks in an npm package update?

If 'npm package update' includes the ability to modify strings in served pages, one would assume so.

Check the backlink profile for pages ranking for spam-dominated queries such as "buy CBD oil" or "buy viagra" and you'll see an incredible amount of spam and fraud.

Sucks that despite this being a 20+ year old problem, Google hasn't been able to fix it.

Reply on news.ycombinator.com