50% new NPM packages are spam

This page summarizes the projects mentioned and recommended in the original post on news.ycombinator.com

Our great sponsors
  • WorkOS - The modern identity platform for B2B SaaS
  • InfluxDB - Power Real-Time Data Analytics at Scale
  • SaaSHub - Software Alternatives and Reviews
  • crev

    Socially scalable Code REView and recommendation system that we desperately need. See http://github.com/crev-dev/cargo-crev for real implemenation.

  • Looks like there's an implementation of it for npm: https://github.com/crev-dev/crev

    I've been willing to try it for a while for Rust projects but never committed to spend the time. Any feedback?

  • rekor

    Software Supply Chain Transparency Log

  • WorkOS

    The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

    WorkOS logo
  • AmazingProject

    An Amazing Project to send amazing pull requests to

  • I guess my AmazingProject https://github.com/bryanrasmussen/AmazingProject that I made 97% as a joke when someone was running a code camp or whatever and a bunch of newbies where creating projects with the word Amazing in it would be grounds for punishment under a lot of regulatory regimes.

  • ansi-black

    The color black, in ansi.

  • > When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant, as well as take up names that could go towards code that is actually useful. I wouldn't be surprised if a significant number of spam NPM packages were these boot camp assignments.

    To me seeing these types of behaviors from an applicant would be a pretty big red flag. I'm just thinking of the disaster that was Hacktoberfest 2020 after a YouTuber popular among bootcampers and students in India taught his audience how to make a (spammy) PR in order to win a 5$ T-shirt. [0]

    A pattern I've seen with bootcamps is that students will build a "portfolio" on GitHub and everyone from the same cohort will build the exact same project because most of the bootcamp is a "fill in the blanks" exercise from the same template. As in, there's a 95% match among the same cohort. This type of "GitHub gaming" was pushed to the extreme by someone who created one package for every ANSI escape code. All of his packages end up including one another and the author PR'd them into popular projects so using those give him downloads and boost his rank [1].

    We pretty much stopped recruiting from bootcamps because the signal to noise ratio was just too low.

    [0] https://joel.net/how-one-guy-ruined-hacktoberfest2020-drama

    [1] https://github.com/jonschlinkert/ansi-black

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts