←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 2 comments | 08 Sep 25 15:37 UTC | HN request time: 0.001s | source
Show context
nromiun ◴[08 Sep 25 16:19 UTC] No.45170180[source]▶
I have nothing to do with this but still I am getting second hand embarrassment. Here is an example, is-arrayish package, 73.8 MILLION downloads per week. The code? 3 lines to check if an object can be used like an array.

I am sorry, but this is not due to not having a good standard library, this is just bad programming. Just pure laziness. At this point just blacklist every package starting with is-.

replies(5): >>45170288 #>>45170925 #>>45172151 #>>45173397 #>>45175092 #
zahlman ◴[08 Sep 25 16:27 UTC] No.45170288[source]▶
Meanwhile in Python: 134 million weekly downloads, seemingly slowly trending upward over time, for https://pypistats.org/packages/six which provides third-party compatibility for a version of Python that dropped support over five years ago.
replies(3): >>45170340 #>>45172271 #>>45175962 #
1. nromiun ◴[08 Sep 25 16:31 UTC] No.45170340[source]▶
The code is 813 lines [0]. Not saying everyone should use it but these two are not directly comparable.

[0] https://github.com/benjaminp/six/blob/main/six.py

replies(1): >>45170386 #
2. zahlman ◴[08 Sep 25 16:34 UTC] No.45170386[source]▶
It is much more code, but it should be even more useless. (No slight intended to Benjamin Peterson.) The 2.7 window was already extended to give everyone a chance to migrate.