Hacker News Reader

> All of these packages have just two files: package.json and index.js (or main.js). This is one of several flags that you can use to determine if a package is legit or not.

Wouldn't a lot of small packages consist of just these two files, meaning seeing just these two files in a package may raise an eyebrow but hardly be a smoking gun?

View on HN

It's not a smoking gun. It is just one of a number of signals you look for when identifying potentially malicious packages. Other things you look for are number of collaborators, how long it existed, domains it talks to, and artifacts it pulls in.

> are number of collaborators

You have any idea how easy it is to fake it?

Also, snyk doesn't scan code that isn't on github, because they are under the impression that all the code in the world is on github, so things like gnome.org, debian salsa or codeberg are completely ignored.

So you won't get reliable data from snyk.

edit: snyk doesn't scan code at all, they rely on unrelated "metrics" to give a rating that is not very useful.

Reply on news.ycombinator.com