SAN FRANCISCO, CA - In the wake of a devastating supply chain attack in the npm registry that left millions of enterprise applications compromised and billions of user records exposed, developers across the JavaScript ecosystem expressed deep sorrow today, lamenting that such a crisis was completely unavoidable.
“It’s a shame, but what can you do? This is just the price of building modern web apps,” said Senior Frontend Engineer Mark Vance, echoing the sentiments of a community that completely relies on a 40-level-deep nested tree of unvetted packages maintained by pseudonymous strangers to capitalize a single string. “There’s absolutely no way to foresee or prevent someone from taking over a long-abandoned utility package and injecting a crypto-miner into every production build in the world. It’s just an act of nature.”
Npm having a lot of packages at least partially a problem of lacking standard library, no? And partially developer culture where every trivial thing is a package. Anyway, similar thing will happen to rust soon enough (*looks at 1 gig of dependencies for a cli program*).
“Look at how all these much smaller package ecosystems don’t have the problems of the largest one.”
is the tl;dr of this article.
Npm having a lot of packages at least partially a problem of lacking standard library, no? And partially developer culture where every trivial thing is a package. Anyway, similar thing will happen to rust soon enough (*looks at 1 gig of dependencies for a cli program*).