Skip to content

Increased load due to badges on cnpmjs.org #141

Open
Open
Increased load due to badges on cnpmjs.org#141
Labels
questionFurther information is requested

Description

@styfle
styfle
opened on Sep 27, 2018

Today I noticed some slowness and some intermittent connection issues.

I thought maybe zeit was down but it turns out, the server load has increased quite a bit.

A lot of that is coming from Chinese mirrors.

npm.taobao.org

image

cnpmjs.org

image

But these packages don't look real.

strange logs

image

So should I attempt to block these based on referrer or maybe add an API key so I know where traffic is coming from?

Activity

  1. styfle
    added
    questionFurther information is requested
    on Sep 27, 2018

  2. amio commented on Sep 27, 2018

    @amio
    amio
    on Sep 27, 2018
    Collaborator

    TAONPM now using packagephobia badge on package page
    https://npm.taobao.org/package/koa-body
    https://npm.taobao.org/package/paypal-adder-online-2018

  3. styfle commented on Sep 27, 2018

    @styfle
    styfle
    on Sep 27, 2018
    OwnerAuthor

    Well that is really cool 😄

    But it seems like the second one is not a package in npm 🤔

    https://www.npmjs.com/package/paypal-adder-online-2018

  4. amio commented on Sep 27, 2018

    @amio
    amio
    on Sep 27, 2018
    Collaborator

    That's nice 👍

    While some package looks like scams:

    I've raise an issue at https://github.com/cnpm/registry.cnpmjs.org/issues/10

  5. styfle commented on Sep 28, 2018

    @styfle
    styfle
    on Sep 28, 2018
    OwnerAuthor

    Thanks for creating the issue!

    I hope the authors will get in contact because they have increased my data storage by 10x (went from 5,000 keys to 50,000 keys in a week).

    image

    Maybe @fengmk2 (the author of cnpm) can comment here 😄

  6. amio commented on Sep 29, 2018

    @amio
    amio
    on Sep 29, 2018
    Collaborator

    @styfle Are those requests from normal badge or broken badge?

  7. amio commented on Sep 29, 2018

    @amio
    amio
    on Sep 29, 2018
    Collaborator

    Someone familiar with cnpm team told me that (packages missing on npm) might be the cache of cnpm. The original package is deleted on npm, but cnpm hasn't prune the cache for them.

    In this case, I think the bad requests should only consume small part of traffic 🤔

  8. fengmk2 commented on Sep 29, 2018

    @fengmk2
    fengmk2
    on Sep 29, 2018

    cnpm is disable sync unpublished package from npmjs.org. So the un exists packages still exists on cnpmjs.org. 😢

  9. fengmk2 commented on Sep 29, 2018

    @fengmk2
    fengmk2
    on Sep 29, 2018

    @styfle should I remove the install badge from https://npm.taobao.org/?

  10. styfle commented on Sep 29, 2018

    @styfle
    styfle
    on Sep 29, 2018
    OwnerAuthor

    @amio The chart I posted is showing the redis data storage so it’s for packages that exist. I’m not sure if zeit now has a good way to count logs but I can see that the redis cache hit ratio dropped from 60% to 40% so that’s likely from all of the removed packages.

  11. styfle commented on Sep 29, 2018

    @styfle
    styfle
    on Sep 29, 2018
    OwnerAuthor

    @fengmk2 I wasn’t aware that you were going to add the badge to the website. It would have been nice to know ahead of time.

    That being said, my long term goal was to get this data added on the true npmjs.com website so this is a great start.

    I’m a bit concerned about how much I’ll pay out of my own pocket for data storage, especially since there are several feature requests (#87 and #124) which would track even more data points.

    Can you change the badge logic on cnpm so it only displays if the package has more than 1000 downloads per month? (This could greatly reduce the load on my servers and also prevent the fake packages from even hitting the server at all)

  12. fengmk2 commented on Sep 29, 2018

    @fengmk2
    fengmk2
    on Sep 29, 2018

    @styfle Sure!

  13. styfle
    changed the title [-]Possible bad actors[/-] [+]Increased load due to badges on cnpmjs.org[/+] on Sep 29, 2018

  14. styfle commented on Oct 9, 2018

    @styfle
    styfle
    on Oct 9, 2018
    OwnerAuthor

    @fengmk2 I'm still seeing fake npm packages such as the following:

    /badge?p=corel-draw-x7-activation-code-2018-crack-keygen@1.0.0
/badge?p=hack-cats-crash-arena-turbo-stars-cheat-coins-unlimited-2018@1.0.0
/badge?p=kaspersky-internet-security-premium-serial-number-key-keygen-license-generator-and-activator@1.0.0
/badge?p=8-ball-pool-hack-no-verification-2018@1.0.0
/badge?p=fake-credit-card-generator-with-money-2018@3.0.0
/badge?p=snapchat-views-hack@1.0.0
/badge?p=dream-league-soccer-2018-hack-cheat-coins@3.0.1
/badge?p=parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator@1.0.5
/badge?p=spotify-premium-account-generator-2018@342.0.0
/badge?p=idle-miner-tycoon-hack@1.0.2
/badge?p=free-vbucks-fortnite-vbucks-win@4.0.1
/badge?p=icloud-unlocker-online-2018@1.0.0
/badge?p=farming-usa-h-a-c-k-and-c-h-e-a-t-s-2018@1.0.0

    How can these packages be getting more than 1000 downloads per month if they do not exist?

    Can you avoid making the http request to package phobia if the npm package doesn't exist?

  15. amio commented on Oct 10, 2018

    @amio
    amio
    on Oct 10, 2018
    Collaborator

    @fengmk2 We might need a better strategy for cleaning up deleted packages on cnpm.

  16. fengmk2 commented on Oct 22, 2018

    @fengmk2
    fengmk2
    on Oct 22, 2018

    I had hide the badge if downloads < 1000 now https://cnpmjs.org/package/hack-cats-crash-arena-turbo-stars-cheat-coins-unlimited-2018

  17. styfle commented on Oct 22, 2018

    @styfle
    styfle
    on Oct 22, 2018
    OwnerAuthor

    @fengmk2 Thanks!

    I checked the logs for the last hour and I still see many more non-existent package requests.

    corel-draw-x7-activation-code-2018-crack-keygen
8-ball-pool-hack-no-verification-2018
need-for-speed-payback-cd-key-generator
how-to-recover-deleted-instagram-account
dream-league-soccer-2018-hack-cheat-coins
parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator
bitcoin-generator-hack-free
free-icloud-unlock-service
free-coins-for-house-of-fun-2018
freee-p-s-n-codes-no-human-verification
thepackageofmyldreams
react-native-timeline-list
design-home-cheat-diamond
sketchup-pro-2018-serial-number-2018-key-keygen-license-generator-and-activator
playerunknowns-battlegrounds-key-generator
localiser-un-telephone-portable-gratuitement
football-strike-hack-coins
wso-free-chips-no-verification-2018
private-instagram-profile-viewer-online-2018
@prichodko/react-scripts
snapchat-views-hack
tik-tik-tik-tamil-full-movie-waatch-online-download
paypal-hack-2018-no-survey
moviestarplanet-hack-vip-diamants-gratuit
gta-5-android-download-2018
rules-of-survival-2018-hack-99999

    Why are these still coming through? Can you remove?

  18. fengmk2 commented on Oct 23, 2018

    @fengmk2
    fengmk2
    on Oct 23, 2018

    @fengmk2 Thanks!

    I checked the logs for the last hour and I still see many more non-existent package requests.

    corel-draw-x7-activation-code-2018-crack-keygen
8-ball-pool-hack-no-verification-2018
need-for-speed-payback-cd-key-generator
how-to-recover-deleted-instagram-account
dream-league-soccer-2018-hack-cheat-coins
parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator
bitcoin-generator-hack-free
free-icloud-unlock-service
free-coins-for-house-of-fun-2018
freee-p-s-n-codes-no-human-verification
thepackageofmyldreams
react-native-timeline-list
design-home-cheat-diamond
sketchup-pro-2018-serial-number-2018-key-keygen-license-generator-and-activator
playerunknowns-battlegrounds-key-generator
localiser-un-telephone-portable-gratuitement
football-strike-hack-coins
wso-free-chips-no-verification-2018
private-instagram-profile-viewer-online-2018
@prichodko/react-scripts
snapchat-views-hack
tik-tik-tik-tamil-full-movie-waatch-online-download
paypal-hack-2018-no-survey
moviestarplanet-hack-vip-diamants-gratuit
gta-5-android-download-2018
rules-of-survival-2018-hack-99999

    Why are these still coming through? Can you remove?

    remove now.

  19. styfle commented on Oct 23, 2018

    @styfle
    styfle
    on Oct 23, 2018
    OwnerAuthor

    I am still seeting hits from parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator. Are you sure you removed those?

    Here's some more..

    Package cleanmymac-3-serial-number-updated does not exist in npm
Package parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator does not exist in npm
Package idle-miner-tycoon-hack does not exist in npm
Package sweatcoin-coins-generator does not exist in npm
Package icloud-unlocker-online-2018 does not exist in npm
Package hack-zombie-gunship-survival-cheat-unlimited does not exist in npm
Package cuentas-netflix-gratis does not exist in npm
Package choices-stories-you-play-hack-cheat-diamonds does not exist in npm
Package private-instagram-viewer-no-survey does not exist in npm
Package 172 does not exist in npm
Package 290 does not exist in npm
Package design-home-cheats-hack-2018 does not exist in npm
Package kc-ng2-img-max does not exist in npm
Package the-sims-mobile-hack does not exist in npm
Package kaspersky-internet-security-premium-serial-number-key-keygen-license-generator-and-activator does not exist in npm
Package gta-vice-city-highly-compressed-2018 does not exist in npm
Package design-home-cheats-hack-2018 does not exist in npm
Package diggys-adventure-hack-cheats does not exist in npm
Package gta-vice-city-highly-compressed-2018 does not exist in npm
Package malik-montana-tijara-plyta-chomikuj does not exist in npm
Package aiseesoft-video-converter-ultimate-serial-number-key-keygen-license-activator-generator does not exist in npm
Package @rockit/just-another-logger does not exist in npm
Package angular-mat-time-picker does not exist in npm
Package hack-flip-master-cheats does not exist in npm
Package sweatcoin-coins-generator does not exist in npm
Package minecraft-account-generator-online-2018 does not exist in npm
Package free-robux-no-human-verification does not exist in npm
Package hackear-facebook-online-2018 does not exist in npm
Package free-robux-no-human-verification does not exist in npm
Package free-icloud-unlock-bypass does not exist in npm
Package free-robux-no-human-verification does not exist in npm
Package parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator does not exist in npm
Package ultimate-netflix-accounts-generator-free does not exist in npm
Package free-iphone-x-giveaway-contest-2018 does not exist in npm
Package hack-webkinz-codes does not exist in npm
Package leaked-snapchats-wiki-online-2018 does not exist in npm
Package toon-blast-hack-cheat-coins does not exist in npm
Package @casdl/seo does not exist in npm
Package lords-mobile-unlimited-gems-and-gold does not exist in npm
Package hack-fifa-mobile-soccer-cheat-unlimited-coins does not exist in npm
Package seekers-notes-hackz-2018-noverification does not exist in npm
Package windows-7-ultimate-highly-compressed-working does not exist in npm
Package microsoft-office-2007-highly-compressed-working does not exist in npm
Package sky-force-reloaded-hack does not exist in npm
Package parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator does not exist in npm
Package shadow-fight-3-hack-2018-no-verification does not exist in npm

  20. styfle commented on Oct 27, 2018

    @styfle
    styfle
    on Oct 27, 2018
    OwnerAuthor

    @fengmk2 Maybe these malware packages have over 1000 downloads.

    Can you change it to only hide the badge if total downloads < 50000?

  21. Repository owner deleted a comment from on Apr 20, 2019

  22. styfle commented on Mar 7, 2021

    @styfle
    styfle
    on Mar 7, 2021
    OwnerAuthor

    @fengmk2 Can you update cnpmjs.org links from packagephobia.now.sh to packagephobia.com? Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    questionFurther information is requested

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions