More than half of all new packages that are currently (29 Mar 2023) being submitted to npm are SEO spam. That is - empty packages, with just a single README file that contains links to various malicious websites. https://datawrapper.dwcdn.net/ZkWKj/2...

Markdown supported · ⌘↵ to post
I appreciate the research, but can’t get over the irony of Sandworm being also the name of a known Russian cyber criminal group :)
メイヤーオーステイン
I love the name. You could have called it shai-hulud 😂
Good work in helping to improve the npm community!