Malicious npm Packages Evade Traditional Defenses

"Developers are advised not to rely on install-time scanning alone, and to also employ runtime behavioral analysis," the commenter quoted from the linked article — and then used that line to frame a wider critique of JavaScript, open-source dependencies, and the institutions that govern software.

JavaScript framed as a "pest" worse than Flash

The author of the comment objects strongly to the ubiquity of JavaScript, calling it a "pest" and arguing many sites, apps, systems, operating systems and files "could do/function just fine without" it. The post explicitly compares JavaScript unfavorably to Flash, which the author says "went first" after people recognized its security problems, while JavaScript remains ubiquitous despite being, in the author’s view, "worse security wise."

That criticism extends to standards bodies. The commenter names the W3C and blames it for "insist[ing] that they must be able to run code on a client computer," arguing every time the standards force a client-side executable into Web specifications it becomes "a major security fault."

Install-time scanning versus runtime and "probabilistic" defenses

Quoting the linked article’s advice not to rely solely on install-time scanning, the commenter endorses runtime behavioral analysis and adds an older framing: "Castles-v-Prisons" (also referenced as C-v-P and CvP). The comment asserts that malware cannot hide its runtime signature or the changes it makes when a hypervisor is in place and using "probabilistic" methods to look for such changes.

The post argues today's defenders call part of this "runtime behavioural analysis" but miss security benefits that the author associates with "prisons" and probabilistic approaches compared with "castle" defenses. The comment also recounts an allegation that research from Cambridge Computer Lab was taken and commercialized after a move to "University College London," saying a graduate "stole the work and set up a company to try and sell it."

Dependency management and distrust of open-source funding

The commenter describes a "dependencies nightmare" in free and open-source software (FOSS): attempts to remove an unwanted component can break other parts of a system because of shared dependencies, with CUPS offered as an example of software that is hard to remove without collateral damage. Beyond technical fragility, the author claims some FOSS projects accept "donations" or grants from Microsoft and then "quietly return the favor by incorporating some or many of MS 'ideas' or concepts" into their packages — a change the comment calls "truly disgusting."

That distrust feeds into advice the author has given historically: to turn JavaScript off in the browser and to uninstall client-side execution where practical. The commenter says they have "yet to find a server that runs javascript on a clients computer that is actually worth bothering with."

Allegations of surveillance, legal abuse, and personal grievance

The comment shifts from technical critique to sustained personal claims: the author says they and their family have been subject to 24/7 real-time eavesdropping and "warrantless surveillance," refers to being convicted a felon they assert their government wanted, alleges an attempt on their life was covered up, and says local authorities—referred to as "the HICKS here in ID"—have denied them access to a lawyer. The author names a mental-health professional, Thad Koontz, and reports being told their diagnosis of delusional was connected to trusting the public defender and believing in "the rule of law." The comment ends with a broad denunciation of government actors as "MONSTERS" and an appeal to publicize perceived dangers.

What this means for developers, open-source maintainers, and end users

• Developers and security teams: The quoted guidance — not to rely on install-time scanning alone — is reinforced by the commenter’s call for runtime behavioral analysis and attention to hypervisor-based, probabilistic detection. The comment suggests defenders should combine static checks with behavioral monitoring.
• Open-source maintainers and project funders: The author’s allegation that donations influence design choices signals a trust problem; maintainers who accept external funding may face scrutiny from users worried about hidden influence or shifts in project direction.
• End users and privacy-minded individuals: The comment reiterates a longstanding recommendation to minimize client-side executable content — including turning off JavaScript where feasible — and frames dependency complexity as an obstacle to regaining control of systems.

The original comment ties a narrow, technical admonition — that install-time scanning is insufficient — to wider, deeply felt distrust: of client-side code, of dependency ecosystems, of standards bodies, and of authorities. Whether readers take the post as technical prescription, a manifesto of personal grievance, or both, its central technical claim is clear: combine install-time checks with runtime behavioral analysis and pay attention to provenance and dependency complexity. The post closes on an insistence that these risks matter beyond code, shaping how the author sees institutions and personal security.

https://www.schneier.com/blog/archives/2026/09/malicious-npm-packages-that-evade-defenses.html