A blog post detailing how a single buyer planted backdoors in 30+ WordPress plugins drove 61,932 visits and 74,659 pageviews over 17 days — the biggest viral run in anchor.host history. TechCrunch, Golem.de, t3n, TechRadar, JPCERT, Gigazine, BFM TV, and a YouTube video at 1.4K visits all carried the story.
Eastern Time. The post sat for four days after the X share, then Reddit picked it up at 1:35 AM, HN hit the front page eight hours later, and TechCrunch published a dedicated article the following afternoon — driving the largest single day of the run.
Hacker News drove a quarter of all visits — but unlike most viral runs, direct visits dominated at 46%, the result of dozens of news outlets, plugin vendors, and WordPress communities pasting the link directly. The European tech press (Golem, t3n, BFM, Meneame) and Japanese outlets (JPCERT, Gigazine) carried the story aggressively.
Thirty-plus sources sent meaningful traffic. European tech press dominated the long tail: Golem.de (1,500 visits), t3n.de (1,080), BFM TV (503), Meneame (438) — TechCrunch alone is buried in the 'direct' bucket because Apple News, RSS readers, and email forwards strip referrers. The YouTube video on this story drove 1,431 visits all by itself.
The HN thread quickly pivoted to a broader supply-chain anxiety — npm dependencies, cryptocurrency-funded attacks, and the FAIR decentralized package manager all came up. The dev community sees this as an inflection point, not an outlier.
Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specific development for making things dramatically worse, it's cryptocurrencies — they monetize attacks that previously had no profit motive.
The prevailing wisdom has thus far been: "don't re-invent the wheel". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.
I really wish that the FAIR package manager project had been successful. FAIR has a very interesting architecture, inspired by atproto, that I think has the potential to mitigate some of the supply-chain attacks we've seen recently. There's no central package repository — anyone can run one.
More desktop than phone for this one — sysadmins and developers reading at work. Germany #2 by country (driven by the Golem.de + t3n coverage), and Japan #5 thanks to JPCERT + Gigazine.
For context: anchor.host averages ~2,186 visits per day over the prior 30 days. This single post brought in ~28× a normal day's site traffic over 17 days, with a peak of 19,715 visits in a single day on Apr 14 — the day TechCrunch published.