Self-propagating worm fuels latest npm supply chain compromise The npm platform is the target of another supply chain attack, with crims already compromising 187 packages and counting. According to Charlie Eriksen, malware researcher at Aikido, the attacker appears to be the same one who targeted Nx at the end of August – a campaign in which developers' secrets, such as credentials, were …
Open source is built on a constant gaslight: developers are told they’re part of a noble 'community,' that their weekends poured into debugging and patching are a ‘gift to humanity.’ Meanwhile, corporations harvest that work, ship billion-dollar products on top of it, and then feign surprise when the unpaid maintainers burn out or get compromised. This is structural exploitation: free labour dressed up as prestige, free R&D laundered as 'ecosystem.' And when the house of cards collapses, those same companies plead innocence as if they weren’t the ones pocketing the margins.
Sadly it has been a trend for quite some time that your dedication to free code projects and your GitHub page is pretty much a CV. They want passionate people who do it for fun. No wonder so many in the OSS community burn out. There's always another wide-eyed developer ready to be exploited and ground to dust. Possibly hyperbolic but it seems to fit a pattern.
Well I have spent a lot of doing "open source" work and putting it on GitHub (as free hosting) in the full knowledge that nobody will make a penny from anything I have done there ;)
I strongly suspect I am not alone. Think of it as vanity publishing.
It IS good as a "partial" CV, just don't do anything commercially useful!
Yes, that's the whole idea of "open source" - you write proprietary software without getting paid and of course the end result is that usually humanity is harmed more than it is helped.
If you want to program something for a real community - you should develop free software and license it under a strong license like the GPLv3-or-later or better AGPLv3-or-later.
Although corporations can use such software - being required to respect the users freedom means that most corporations don't.
That was Stalman orginal plan from inception. Basically he wanted not to pay for software, have people working for free for him, so he could use his budget for something else, and without giving away his personal use code.
Brainwash enough people they are working for a "better good", and avoid to pay them, or pay them peanuts. Maybe with the help of those handsomely paid by some companies to run some projects they need to reduce their own investment and expenses - like the Linux kernel. Win-win!
Look in another article how KDE needs a patron to sustain its development, or a "socialits commune" (whatever it means and how do they get money to live).
FOSS is not a viable business model but for real "community" projects, relatively small ones with a specific focus. A whole IT based on small packages from a lone, unpaid developer in Nebraska is pure madness and greed.
“The attack began with a meticulously planned phishing campaign targeting NPM package maintainers. Josh Junon, maintainer of critical JavaScript infrastructure packages, provided insight into the attack vector on Hacker News:”
“The attackers had registered the domain npmjs.help on September 5, 2025, creating a convincing impersonation of NPM’s legitimate infrastructure. The phishing emails claimed urgent 2FA updates were required by September 10, 2025, exploiting maintainer fatigue and creating artificial urgency.”
Not a developer at this time, just a humble user.
Firefox runs java script, i use no-script for most sites but allow some to run.
Can I catch these npm infected viruses too? Or is it only a problem for hosting sites and developers?
inquiring mind want to know...
Chances are the code will only be running on the developers computer, _but_ if a developer deploys something and you are a user of aforementioned something then it's possible that it could be set up to harvest your credentials for that site, or anything linked to that site.
While this definitely does not include the register, many sites on the internet already contain malware in the form of JavaScript intentionally or unintentionally added by the site host (which you seem to realize as you use noscript on most sites).
You can confirm this by opening up performance monitoring software like htop and then visiting a random website and seeing how much CPU and RAM usage spikes and then proceeding to disable JavaScript and refreshing the page and seeing if the page works and how much CPU and RAM usage you have then.
For most sites, there is either no visual difference, or there is a visual improvement, with popups and ads no longer appearing and your computer no longer gets flogged.
If the JavaScript doesn't contribute to the page, or causes a negative to the page, clearly that JavaScript is malware - as it does malicious operations that you do not want done.
There is a sandbox that stops JavaScript malware from easily going and accessing your filesystem and other things, but sandbox bypasses are regularly found;
https://thehackernews.com/2024/10/mozilla-warns-of-active-exploitation-in.html
https://thehackernews.com/2025/07/google-patches-critical-zero-day-flaw.html
Such sandbox is also full of holes - for example, websites are allowed to connect to whatever ports on localhost and possibly even connect to other computers on your LAN like your router (unless such access is disallowed by a "CORS"...that the site sets);
https://bugzilla.mozilla.org/show_bug.cgi?id=354493
https://localmess.github.io/
There is limited mitigations like this uBlock script; https://raw.githubusercontent.com/uBlockOrigin/uAssets/refs/heads/master/filters/lan-block.txt but the only way to defend against such attacks with certainty is to go into about:config and set javascript.enabled=false and restart the browser (noscript is quite good at blocking JavaScript now, but in the past it was found to not block some JavaScript; https://www.invicti.com/blog/web-security/noscript-vulnerability-tor-browser/).
npm seems to be equally used for "desktop software", server backend software and website software.
For a "website" that uses npm packages, if the developer was to use the typical npm development technique of pulling in many packages for everything - for example isEven, soon enough there will be thousands upon thousands of dependencies - resulting in an extremely high chance that eventually, at least one dependency eventually will have malware added and therefore resulting in the "website" containing malware (which nobody will notice in the pile of JavaScript).
The attacker could be clever and carry out a sandbox bypass and hijack your entire computer, or even without a sandbox bypass could do any calculation (JavaScript is Turing tarpit complete), including mining cryptocurrency - although it seems most attackers are primarily interested in spying on you via fingerprinting of your browser etc.
