Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

I think these kinds of attack would be strongly reduced if js had a strong standard library.

If it was provided, it would significantly trim dependency trees of all the small utility libraries.

Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being included/forked.

Ever seen XKCD #927? (https://xkcd.com/927)

Joking aside, I don't think there ever really was a lack of initiatives by entities (communities, companies, whatever) to create some sort of standard library (we typically tend to call them frameworks). There's just simply too much diversity, cultures and subcultures within the whole JavaScript sphere to ever get a global consensus on what that "standard" library then should look like. Not to mention the commercial entities with very real stakes in things they might not want to relinquish to some global unity consensus (as it may practically hurt their current bottom line).

> Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being included/forked.

Debian is a common community effort to create a “distro” of curated and safe dependencies one can install safely.

If you want stable, tested versions of software, only getting new versions every few years:

https://packages.debian.org/stable/javascript/

If you want the newer versions of software, less tested, getting new versions continuously:

https://packages.debian.org/unstable/javascript/

Node.js has been adding APIs that make it feasible to write stuff without dependencies, it's slowly getting there.

What stuff?