I had never done open source. Then I got a 12-hour problem about catching malicious npm packages.

Abhishek kumar — Sun, 01 Nov 2026 00:19:23 +0000

ok so it's 2 AM, I'm sitting in a classroom at my own university, my laptop is getting hot, and I'm looking at CI and CD pipe lines. And I'm thinking, why did I even sign up for this.

Let me start from the beginning.

Hacktoberfest came to my college
I study at Rishihood University, Sonipat. This time Hacktoberfest Hack Day was happening in our own campus, organised by MLH, NST and WeMakeDevs. Lot of students from other places also came for it.

Things started around 4 PM on 31 Oct, and the official hackathon began at 6:30 PM. We were free till 11 PM, after that everyone had to stay in the rooms and work. The university gave us few classrooms for this, so the whole night we were basically living in a classroom.

I have done hackathons before, so I thought ok this will be normal. But I have never done open source. I know what it is, but I never actually did it. Never made a PR to any real project.

Then the problem statements came
There were 8 problem statements and honestly I got nervous after seeing them. All of them were about helping open source maintainers. I have never built anything like this. I don't know how to design things properly and build from scratch, I am still learning that. Mostly I have built things by following tutorials.

We were a team of 4 and we picked Problem 4: "Does the package match its source?"

Basically, when you install an npm package, you trust that the code inside it is same as the code on GitHub. But what if it is not? What if somebody hid a postinstall script in it, or some weird obfuscated file that is not there in the repo at all? Our tool had to compare the published package with its source code, explain every difference, and give alert if something looks suspicious.

I read it and thought, ok, where do I even start.

The rules were different
This hackathon was not like the ones I did before. There were rules like:

start with an empty public repo with an open source license
first commit should be a HACKATHON.md file with our problem, team and which models we use
after that nobody can push directly to main, every change has to be a pull request and CI should pass
First I felt this is too much, why so strict. But later I understood, this is how real open source projects actually work. We were not just making a project for one night, we were working like real maintainers. Everything was gng in place but, then the CI and entire structure got strucked. Then we went throught the entire flow and went on fixing the error.

What happened during the night
We were following our team lead Animesh commands and went of developing the model, but i had made few wrong push in the main branch, and no one in my group know that. Due to that we got many errors and Rishabh caught the error, then he took my laptop and fixed the mess i made throught out the night. I didnt had any clue wt i did but at the end it got fixed.

Biggest thing I learned from this was that it was right decission to take part in such hackathons, bcoz i still dont know many things but i keep on participating in such hackathons. That helped me lot every time i get to learn many things and i get to feel every time that i am the dumbest in my team.

The community was the best part
I didn't expect this but the best part for me was not the coding, it was the people. We got to listen to people who are really in open source, GSoC contributors, mentors, people from Kubernetes and the WeMakeDevs team. I still remember one of the speaker said that we should not do OpenSource just for money or the perks we get, we do OpenSource for helping people and building community and that hit me hard.

What I noticed is how helpful these people are. Nobody is paying them, still they help students they have never met, for free. Mentors stayed with us till midnight to clear our doubts. I realised that open source community runs because someone once helped them, and now they are helping others.

I also understood that open source can be a real career option. Before today I thought OpenSource is just for to crack Gsoc but after today session i came to know throught OpenSource we can also get oppertinities at LFX,Summer_of_bitcoin,MLH,Google_session_of_docs and out_reach. Before this I thought job means resume and interview only. Now I see there is another way, you build in public, you help people, and your work shows who you are.

One more thing, the organisers told that earlier Hacktoberfest was just about counting contributions and because of that lot of spam came. Now they want people to solve real problems. Even one of the problems was about building trust network against AI slop. I liked that, quality matters more than numbers.

If you are a beginner like me
You don't need to be ready. I was not ready also, I just started.
Ask for help early. Mentors like Sai Udayagiri are there for this. I wasted time before I understood it.
Make small PRs, they are easy to fix and easy to understand.
It's ok to be stuck. Everyone around you was stuck at some point.
Where I am right now
It's 3:00 am and I am running on Burger and Coke. Our project is still in progress with lots of work beeing pending. Whatever result comes, I got something I didn't have yesterday, my first real open source experience. And I feel more confident now that even if I don't understand a problem, I can sit with it and make some progress.

Next I want to learn more about OpenSource and find good repos and hit my first PR and start contributing.

If you are also thinking "I will try open source later when I am ready", just don't wait. Go to the next Hacktoberfest event and start.

Our repo: https://github.com/AnimeshPriyanshu/pkgcheck

DEV Community: Abhishek kumar

I had never done open source. Then I got a 12-hour problem about catching malicious npm packages.