NPM: It's Spammers Party Time 🥳
Published: 2024-05-10 06:25:49

Welcome,

As a **Spammer** of the registry *(*[*pun intended*](https://dev.to/thangaganapathy/i-published-a-dummy-pkg-to-npm-and-here-is-what-happened-229k)*)*, I want to explain to you what's going on with the NPM registry and its management.

At first, I felt the title itself offensive or unlawful or disrespectful and also asked help from an AI chatbot, got the following results but I purposefully stayed with the same to get attention from both **NPM** and the **dev** community.

**AI Chatbot**: Certainly! Here are some alternative titles for your blog post on spammers in the NPM registry:

1. **“Navigating the Murky Waters: A Deep Dive into NPM Registry Spam”**
    
2. **“Guarding the NPM Gates: Strategies to Combat Registry Spam”**
    
3. **“Unmasking the Shadows: Inside the World of NPM Registry Spammers”**
    

Let's start with some basics and I request that you have a close look at the forthcoming screenshots.

## What is NPM?

It is the world's largest software registry and a Node Package Manager for the JavaScript programming language maintained by Microsoft's npm, Inc.

![NPM numbers](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bsrew294ejej66feyned.png)

## **Types of Spam**

Let's list out some with my experience and a few real examples currently living in the registry.

* **Keyword Stuffing**:
    
    Packages using irrelevant keywords to appear in more search results.    
    
![Keywords](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9i3mfo6w9bisvhcuiotc.png)
    
* **Malicious Code**:
    
    Packages containing harmful code or backdoors.
    
* **Rewarding decentralized protocol (New Type)**:
    
    These packages were created to get some incentives from the OSS block chain technology. You can [learn more from here](https://blog.sonatype.com/devs-flood-npm-with-10000-packages-to-reward-themselves-with-tea-tokens).    
    
![tea 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nb6343j3c1fdnssmw291.png)

![tea 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9v5epjznox1cw9f1o1lh.png)
    
* **Fake Packages**:
    
    Impersonating popular packages to deceive users.
    
* **Low-Quality Packages**:
    
    Flooded with typos, irrelevant content, or empty functionality.    
    
![Low quality](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/frl5u2bgkxabq96bzp0a.png)
    
* **Bot-Generated Packages**:
    
    Automated spam submissions.    
    
![Bot generated](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zjj3xsvwz1bmd2db32ja.png)
    
* **Phishing Attempts**:
    
    Packages designed to steal sensitive information.
    
* **Dependency Spam**:
    
    Malicious packages as dependencies of legitimate ones.
    
* **Hello World Packages (Low priority issue)**:
    
    The students & learners try their first-time packages.    
   
![hello world pkgs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ydmy1sw4754ozz7li99h.png)
    
* **Weird Packages:**
    
    There are many packages with index.js file containing a comment which says something like the below and I try to understand with the google translator, no luck, if you got it, please let me know in the comments. 

![google translator](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fqsuwltn6thada3sntl7.png)

* **Fancy Packages Control**:
    
    These kinds of users acquire short package names.
    
![fancy pkgs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ekl8wgpnaxxa5ms9bhct.png)

![cvv](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mrld8jd4s8wmr6l0tuqh.png)

**NOTE**: This list excludes security related malicious packages as they are often reported by the experts.

**Some notable past incidents**:

* [https://www.sonatype.com/resources/blog/npm-flooded-with-748-packages-that-store-movies](https://www.sonatype.com/resources/blog/npm-flooded-with-748-packages-that-store-movies)
    
* [https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html](https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html)
    
* [https://thehackernews.com/2023/08/malicious-npm-packages-found.html](https://thehackernews.com/2023/08/malicious-npm-packages-found.html)    

## Some Spammers List

Here I am going to list out some of them because it is simply not possible to list all of them here. Also, with the number of packages published by each one.

1. [https://www.npmjs.com/~onedionysc](https://www.npmjs.com/~onedionysc) - **6931**
    
2. [https://www.npmjs.com/~shivamkalsi2024](https://www.npmjs.com/~shivamkalsi2024) - 997
    
3. [https://www.npmjs.com/~79w](https://www.npmjs.com/~79w) - 551
    
4. [https://www.npmjs.com/~ellentea](https://www.npmjs.com/~ellentea) - 599
    
5. [https://www.npmjs.com/~uirewikilabs](https://www.npmjs.com/~uirewikilabs) - 323
    
6. [https://www.npmjs.com/~quinterochris100](https://www.npmjs.com/~quinterochris100) - 361
    
7. [https://www.npmjs.com/~vanthuanbt26](https://www.npmjs.com/~vanthuanbt26) - 250
    
8. [https://www.npmjs.com/~tiengiangb47](https://www.npmjs.com/~tiengiangb47) - 230
    
9. [https://www.npmjs.com/~swenkertreanpm](https://www.npmjs.com/~swenkertreanpm) - 227
    
10. [https://www.npmjs.com/~loandinhb931](https://www.npmjs.com/~loandinhb931) - 224
    
These are my random picks and who knows how many of them are.

## The Team's Response

![team response 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2yyhgfyfx2awl4220xqf.png)

![team response 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/owrj8f7fdj1hw8wt2twb.png)

![team response 3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0or19b7z9ausy2if927a.png)

## The Problem

The problem is not the spammers, as they always will be, but the real problem is within the management.

Take for example,

If someone reports this via one of your support forums, the reply they get is simply redirection; they are redirecting you to fill out their respective forms for spam submissions.

What if the reporter did not want to do **extra** work here?

The important thing to note here is that the spammers and their packages live happily even after we provide the absolute spam users and their package links.

## Conclusion

I am writing this blog because I waited too long for them to fix it.

> **Justice delayed is justice denied**
> 
> \- William Blackstone

Please don't forget to check out our `important` Articles:

* [**Introducing Our New JavaScript Standard Library**](https://dev.to/thangaganapathy/introducing-our-new-javascript-standard-library-4k22)
    
* [**You Don’t Need JavaScript Native Methods!**](https://dev.to/thangaganapathy/you-dont-need-javascript-native-methods-58bo)    

Happy coding! 🚀

🙏 Thanks for reading.