Crypto enthusiasts have lately been flooding software registries like npm and PyPI with thousands of bogus packages that add no functional value and instead put a strain on the entire open source ecosystem.

A single instance, recorded by Sonatype in July 2024, saw 281,512 distinct packages appearing on the npmjs.com registry overnight — each package named a gibberish Latin phrase akin to Lorem Ipsum. 

The post Crypto enthusiasts flood npm with more than 281,000 bogus packages overnight appeared first on Security Boulevard.

Ax Sharma

Source: Security Boulevard
Source Link: https://securityboulevard.com/2024/08/crypto-enthusiasts-flood-npm-with-more-than-281000-bogus-packages-overnight/