←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0s | source
Show context
stathibus ◴[08 Sep 25 16:00 UTC] No.45169926[source]▶
As an outsider to the npm ecosystem, reading this list of packages is astonishing. Why do js people import someone else's npm module for every little trivial thing?
replies(11): >>45169990 #>>45169999 #>>45170008 #>>45170014 #>>45170015 #>>45170016 #>>45170038 #>>45170063 #>>45170879 #>>45170926 #>>45170953 #
thewebguyd ◴[08 Sep 25 16:07 UTC] No.45170014[source]▶
Lack of a good batteries-included stdlib. You're either importing a ton of little dependencies (which then depend on other small libraries) or you end up writing a ton of really basic functionality yourself.
replies(7): >>45170048 #>>45170122 #>>45170272 #>>45170290 #>>45170423 #>>45171054 #>>45173580 #
tracker1 ◴[08 Sep 25 16:26 UTC] No.45170272[source]▶
Worth mentioning...

https://jsr.io/@std

replies(1): >>45174518 #
wonger_ ◴[08 Sep 25 21:52 UTC] No.45174518[source]▶
How is this different than npm? It looks like a bunch of third-party packages, just prefixed with std.
replies(2): >>45175441 #>>45176106 #
SahAssar ◴[08 Sep 25 23:24 UTC] No.45175441[source]▶
It's not, and a third of them are tagged as unstable. JSR also still seems to not encourage proper versioning.
replies(1): >>45176120 #
tracker1 ◴[09 Sep 25 00:54 UTC] No.45176120[source]▶
They are published as separate packages, but managed in the same repo by the Deno team. Versioning works fine with JSR.

A fully-formed standard library doesn't spring into existence in a day.

replies(1): >>45176998 #
1. DimmieMan ◴[09 Sep 25 03:19 UTC] No.45176998[source]▶
They seem pretty cautious with that unstable flag too.

UUID v7 for example is unstable and one would be pretty confident in that not changing at this stage.

Many unstable functions have less churn than a lot of other “stable” packages. It’s a standard library so it’s the right place to measure twice before cementing it forever.