4 ms·
I don't doubt that JS development is helped via such packages, but pulling in an external dependency to solely to pad a string seems like a bad idea. Introducin
by stordoff 11y ago
I don't doubt that JS development is helped via such packages, but pulling in an external dependency to solely to pad a string seems like a bad idea. Introducing cascading chains of dependencies that you have no control of (left-pad was republished by someone who was not the original publisher, and AFAICT the original could have been replaced by the original author at any time with a malicious version) strikes me as a great way to create brittle code, both from a security and a stability perspective.
- munro 11y agoNPM restricts the developer from being able to push to the same version of a package twice.
- 33a 11y agoUnless you unpublish then republish over it.
- swang 11y agoThis was possible before but no longer true. A version X will either return the original version X or a does not exist (if you unpublish)
- stordoff 11y agoIf you explicitly requesting a particular version, that mitigates the security concerns to some degree (though as this incident proves, you are still reliant on that version being published for proper functionality). That said, the fact that npm's blog [0] indicates that a republished package (with a new version number) mitigated the issue to some degree, and this comment [1] suggesting that the default behaviour is to get the latest minor release, makes me wonder how widespread of a practice that is in reality. [0] http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm [1] http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-program/#comment-127246 http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how...