---
title: "Discussion on \"One In Two New Npm Packages Is SEO Spam Right Now\" | Hashnode"
description: "Discussion on \"One In Two New Npm Packages Is SEO Spam Right Now\". More than half of all new packages that are currently (29 Mar 2023) being submitted to npm are SEO spam. That is - empty packages, with just a single README file that contains links to various malicious websites.\nhttps://datawrapper.dwcdn.net/ZkWKj/2..."
url: "https://hashnode.com/posts/one-in-two-new-npm-packages-is-seo-spam-right-now/64254ebe5ed9c0b2946b446e"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [One In Two New Npm Packages Is SEO Spam Right Now](https://blog.sandworm.dev/one-in-two-new-npm-packages-is-seo-spam-right-now?utm_source=hashnode&utm_medium=feed)

More than half of all new packages that are currently (29 Mar 2023) being submitted to npm are SEO spam. That is - empty packages, with just a single README file that contains links to various malicious websites. https://datawrapper.dwcdn.net/ZkWKj/2...

Mar 30, 2023 · 3 min read · blog.sandworm.dev  
Read the article

-   [#npm](https://hashnode.com/tag/npm)
-   [#security](https://hashnode.com/tag/security)
-   [#seo](https://hashnode.com/tag/seo)
-   [#nodejs](https://hashnode.com/tag/nodejs)
-   [#javascript](https://hashnode.com/tag/javascript)

## Written by

[Gabi Dobocan](https://hashnode.com/@gabidobo)

@gabidobo

  
[View profile](https://hashnode.com/@gabidobo)

Coder, Founder, Builder. Angelpad & Techstars Alumnus. Forbes 30 Under 30.

Coder, Founder, Builder. Angelpad & Techstars Alumnus. Forbes 30 Under 30.

## Responses 2

Markdown supported · ⌘↵ to post

[メイヤーオーステイン](https://hashnode.com/@mayeraus)

[Mar 30, 2023](https://hashnode.com/posts/one-in-two-new-npm-packages-is-seo-spam-right-now/64254ebe5ed9c0b2946b446e/comment/6426065f975e3bb9a50f63ad)

I love the name. You could have called it shai-hulud 😂

Good work in helping to improve the npm community!

[Sergiy Yavorsky](https://hashnode.com/@RandomSergiy)

[Mar 30, 2023](https://hashnode.com/posts/one-in-two-new-npm-packages-is-seo-spam-right-now/64254ebe5ed9c0b2946b446e/comment/6425d3bb975e3bb9a50f5bfc)

I appreciate the research, but can’t get over the irony of Sandworm being also the name of a known Russian cyber criminal group :)

[Gabi Dobocan](https://hashnode.com/@gabidobo)

[Mar 30, 2023](https://hashnode.com/posts/one-in-two-new-npm-packages-is-seo-spam-right-now/64254ebe5ed9c0b2946b446e/comment/6425d3bb975e3bb9a50f5bfc#reply-6425e7ee6698e5b90d8b88c8)

Yes we get that a lot 😅