Increased load due to badges on cnpmjs.org

[styfle]

Today I noticed some slowness and some intermittent connection issues.

I thought maybe zeit was down but it turns out, the server load has increased quite a bit.

A lot of that is coming from Chinese mirrors.

npm.taobao.org

cnpmjs.org

But these packages don't look real.

strange logs

So should I attempt to block these based on referrer or maybe add an API key so I know where traffic is coming from?

[amio]

TAONPM now using packagephobia badge on package page
https://npm.taobao.org/package/koa-body
https://npm.taobao.org/package/paypal-adder-online-2018

[styfle]

Well that is really cool 😄

But it seems like the second one is not a package in npm 🤔

https://www.npmjs.com/package/paypal-adder-online-2018

[amio]

That's nice 👍

While some package looks like scams:

• https://npm.taobao.org/package/paypal-adder-online-2018
• https://npm.taobao.org/package/paypal-money-a-d-d-e-r-g-e-n-e-r-a-t-o-r-h-a-c-k

I've raise an issue at https://github.com/cnpm/registry.cnpmjs.org/issues/10

[styfle]

Thanks for creating the issue!

I hope the authors will get in contact because they have increased my data storage by 10x (went from 5,000 keys to 50,000 keys in a week).

Maybe @fengmk2 (the author of cnpm) can comment here 😄

[amio]

@styfle Are those requests from normal badge or broken badge?

[amio]

Someone familiar with cnpm team told me that (packages missing on npm) might be the cache of cnpm. The original package is deleted on npm, but cnpm hasn't prune the cache for them.

In this case, I think the bad requests should only consume small part of traffic 🤔

[fengmk2]

cnpm is disable sync unpublished package from npmjs.org. So the un exists packages still exists on cnpmjs.org. 😢

[fengmk2]

@styfle should I remove the install badge from https://npm.taobao.org/?

[styfle]

@amio The chart I posted is showing the redis data storage so it’s for packages that exist. I’m not sure if zeit now has a good way to count logs but I can see that the redis cache hit ratio dropped from 60% to 40% so that’s likely from all of the removed packages.

[styfle]

@fengmk2 I wasn’t aware that you were going to add the badge to the website. It would have been nice to know ahead of time.

That being said, my long term goal was to get this data added on the true npmjs.com website so this is a great start.

I’m a bit concerned about how much I’ll pay out of my own pocket for data storage, especially since there are several feature requests (#87 and #124) which would track even more data points.

Can you change the badge logic on cnpm so it only displays if the package has more than 1000 downloads per month? (This could greatly reduce the load on my servers and also prevent the fake packages from even hitting the server at all)

[fengmk2]

@styfle Sure!

[styfle]

@fengmk2 I'm still seeing fake npm packages such as the following:

/badge?p=corel-draw-x7-activation-code-2018-crack-keygen@1.0.0
/badge?p=hack-cats-crash-arena-turbo-stars-cheat-coins-unlimited-2018@1.0.0
/badge?p=kaspersky-internet-security-premium-serial-number-key-keygen-license-generator-and-activator@1.0.0
/badge?p=8-ball-pool-hack-no-verification-2018@1.0.0
/badge?p=fake-credit-card-generator-with-money-2018@3.0.0
/badge?p=snapchat-views-hack@1.0.0
/badge?p=dream-league-soccer-2018-hack-cheat-coins@3.0.1
/badge?p=parallels-desktop-13-2-0-serial-number-2018-key-keygen-license-generator-and-activator@1.0.5
/badge?p=spotify-premium-account-generator-2018@342.0.0
/badge?p=idle-miner-tycoon-hack@1.0.2
/badge?p=free-vbucks-fortnite-vbucks-win@4.0.1
/badge?p=icloud-unlocker-online-2018@1.0.0
/badge?p=farming-usa-h-a-c-k-and-c-h-e-a-t-s-2018@1.0.0

How can these packages be getting more than 1000 downloads per month if they do not exist?

Can you avoid making the http request to package phobia if the npm package doesn't exist?

[amio]

@fengmk2 We might need a better strategy for cleaning up deleted packages on cnpm.