←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0.228s | source
Show context
stathibus ◴[08 Sep 25 16:00 UTC] No.45169926[source]▶
As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?
replies(11): >>45169990 #>>45169999 #>>45170008 #>>45170014 #>>45170015 #>>45170016 #>>45170038 #>>45170063 #>>45170879 #>>45170926 #>>45170953 #
1. jbreckmckye ◴[08 Sep 25 17:10 UTC] No.45170879[source]▶
"JS people" don't, but certain key dependencies do, and there are social / OSS-political reasons why.

Why do "Java people" depend on lowrie's itext? Remember the leftpad-esque incident he initiated in 2015?