3 ms·
I don't remember the intricacies of NPM or Yarn, but don't one/both of them have resource integrity enabled, so that you know that the package that's being inst
by yladiz 9y ago
I don't remember the intricacies of NPM or Yarn, but don't one/both of them have resource integrity enabled, so that you know that the package that's being installed is the one in your lock file? If not, why isn't this a feature especially after the clusterfuck of the guy deleting all his packages back about two years ago, breaking tons of things including Babel and React?
This wouldn't fix the issue of someone deleting the actual package (this happened here?), but it would prevent some malicious code being installed if someone uses the same package name.
- applecrazy 9y agoCan you link me to the incident where a person deleted their packages and broke Babel? I'd love to read about it. Edit: grammar
- tc7 9y agohttps://www.theverge.com/2016/3/24/11300840/how-an-irate-developer-briefly-broke-javascript https://www.theverge.com/2016/3/24/11300840/how-an-irate-dev...
- applecrazy 9y agoThanks.
- mort96 9y agohttps://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ left-pad was a package to, you guessed it, pad a string with n leading characters. Personally, I've always just written my own 2 line function for it (something like `function pad(s, n, ch) { return new Array(n - s.length).fill(ch).join("") + s; }`), but a bunch of packages either directly or indirectly depended on this left-pad package, so they all broke.
- applecrazy 9y agoPackages broke because of a literal two line function? That's hilarious and terrifying at the same time.
- mort96 9y agoWell... No. the left-pad function is 11 lines. The source code, as it was back then, according to that register article, was like this: function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i < len) { str = ch + str; } return str; } But yes, packages broke because of what _could_ have been implemented in one line (ignoring the two lines for the function signature and closing curly).