←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 2 comments | 08 Sep 25 15:37 UTC | HN request time: 0.623s | source
Show context
tomxor ◴[08 Sep 25 17:06 UTC] No.45170819[source]▶
Finally validated for writing my own damn ANSI escape codes.
replies(1): >>45173233 #
jmull ◴[08 Sep 25 20:04 UTC] No.45173233[source]▶
Yeah, I get that learning the codes is a little annoying, but not actually harder than finding, incorporating, and learning one of the APIs here. Also one is standard while the other is not. Seems a bit nuts to use a package for this.
replies(2): >>45173971 #>>45184261 #
junon ◴[08 Sep 25 21:04 UTC] No.45173971[source]▶
Hi, missing a lot of history here. When Chalk was written, colors in the terminal wasn't a flashy thing people tried to do very often, at least not in the JS world. Coming from browsers and wanting to make CLI apps using the flashy new Node.js 0.10/0.12 at the time saw a lot of designers and other aesthetically-oriented folks with it. Chalk filled a hole for people to do that without needing to understand how TTYs worked.

Node.js proper has floated the idea of including chalk into the standard libraries, FWIW.

replies(2): >>45176413 #>>45181074 #
1. herpdyderp ◴[09 Sep 25 01:39 UTC] No.45176413[source]▶
> Node.js proper has floated the idea of including chalk into the standard libraries, FWIW.

Oh my word please no! Every time I run into an issue where a dependency suddenly isn’t logging colors like it’s supposed to, it always boils down to chalk trying to do something fancy to handle an edge case that doesn’t actually exist. Just log the dang colors!

replies(1): >>45179323 #
2. junon ◴[09 Sep 25 08:49 UTC] No.45179323[source]▶
I'd be curious what those edge cases are, as a maintainer of chalk.