CPAN Trojan Horses

[tqisjim]

I'm probably not the only person to write a CPAN module with an unnecessary dependency. In my case, even though the dependency has some peripheral use, admittedly there are ulterior motives. I'm still working out the mechanics of using optional dependencies for optional functionality. Notwithstanding, I think my approach is too sketchy and one concern is that I can get away with it.

The point is: I recently tried to install another module with the same liability. One particular dependency has many other dependencies (A chain of potential Trojan Horses) and the functionality seems irrelevant.

Are there any standard practices that I can refer to? Some way to confirm my suspicions? Ultimately, should I try to sever the unnecessary dependency myself or is there a better approach to achieve the "greater good"?

Thanks- Jim

[tobyink]

The easy way to do optional dependencies is along these lines:

use constant HAS_LWP => eval "require LWP::UserAgent";

...;

update_cache() if HAS_LWP;
my $data = read_cache();

In terms of META.yml/META.json, there is a facility to indicate optional dependencies, though I don't see it used very often.

[SuicideJunkie]

I personally prefer to use the Foo::Tiny modules where possible. Pure perl and all in one place with no dependencies.

But that's mostly because I don't like hunting down problems in a forest of dependencies and I've been unlucky about that sort of thing early on.

[LanX]

I might frontpage the question if it was clearer... =)

Is it about (irrelevant) dependencies or avoiding trojans or what exactly?

[bulk88]

Trust NOONE. Do not use CPAN. Its filled with spooks and blackhats. See Malware on CPAN.

[thomas895]

Be especially careful with Perl itself. It has a virus that replaces your hard drive's contents with obscene images!

By putting "use" followed by any "module name" you thought was safe, the irreversible process will begin. Oh the horrors, the scarring caused by those pictures of toads...

[sundialsvc4]

I’m a little confused by the use of the term, Trojan Horse, which implies malfeasance . . .

Do you mean, Dependency Hell?   :-)