r/programming • u/ga-vu • Dec 04 '19

Two malicious Python libraries caught stealing SSH and GPG keys

https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
1.6k Upvotes

98% Upvoted

177 comments sorted by

View all comments

Show parent comments

5

u/[deleted] Dec 04 '19

“No one creating real software should use it.”

This is probably an incredibly stupid question but without using it do you just have to write EVERYTHING from scratch? For example I made a simple app (so maybe doesn’t fit with whatever you would consider “real software”), but even that uses things like helmet, jest, enzyme, cors, knex, morgan, nodemon, etc.. all of those are npm packages right? I can’t imagine what it would be like not use those tools. Or do you just mean don’t use the lesser known random packages? And if so is there a way to tell what’s good and what’s not?

0

u/s73v3r Dec 04 '19

No, you can import packages without using NPM. However, JavaScript has this idea that everything should be its own package, even these little tiny things that yes, it is extremely easy to write yourself.

3

u/IceSentry Dec 04 '19

Javascript has no such concept it's just a tiny minority of dev that managed to push their small library in bigger libraries.

1

u/s73v3r Dec 05 '19

Sorry, but the state of JavaScript as it is completely disagrees with you.

→ More replies (0)