DEV Community

Discussion on: How I exploited NPM downloads... and why you shouldn't trust them

Collapse
 
andyrichardsonn profile image
Andy Richardson • Edited

Your argument is based on your exploit, which makes an illogical jump

Sorry if I've made this unclear, there are two main points I'm trying to emphasise. Just in case you missed it 👇

But here's the thing, it isn't a useful metric for the following two reasons:

  • there is a loose (at best) relationship between users and download counts
  • the system is easily exploitable

In terms of the exploit side of things, my personal opinion is that data which can be manipulated to this degree shouldn't be given any weight.

Edit: I've updated the conclusion to remove the emphasis on the latter point - hope that clears up any confusion!