3 ms·
I find this article to be one year late malicious hyperbole and completely useless in redeeming itself with appropriate action items. > Node modules are widesp
by Can_Not 8y ago
I find this article to be one year late malicious hyperbole and completely useless in redeeming itself with appropriate action items.
> Node modules are widespread and ripe for abuse.
Most package systems kind of are, especially when they become more useful.
For real advice: checkout from npm retire and auditjs (there's also more non free options). You'll likely get some false positives (such as, who would host jQuery on a public/untrusted cdn? or why would you even pass user input into that?), but if a real malware actually showed up, you can find out as part of your CI process. Using the lockfile provided by yarn/npm is also a good way to reduce accidental unnecessary package updates.
> Nonsense dependencies are hard if not near impossible to manually audit due to the sheer number of them.
No, they are easier to audit. It's a lot easier to verify that leftpad isn't installing a Bitcoin miner than to verify react isn't installing a Bitcoin miner. React is probably the size of 1000 leftpads, too.
> Manually audit and lock down your dependencies.
No mention of what this is suppose to be. Yarn will lock your dependencies by default. The yarn.lock file will have the exact version locked. I haven't used npm in a while.
> Stop using nonsense dependencies, writing basic code is not reinventing the wheel.
Yes, writing "basic code" is reinventing the wheel. You have at least 10 free fully tested leftpads available on npm but you expect me to write one more? I'm paid to build the application, not to apply non-sense rules. This outrage over microlibraries needs a bit more substance. Your alternatives are basically "write code that already exists" or "use bigger monolithic libraries", and, to be frank, most of us have used other languages before or worked on multiple projects, and we can decide for ourselves if a function should be in in-housed or npm'ed. For something as basic as leftpad, wasting time writing it is just a waste of time. As a hard rule, this rule is garbage. As a soft rule, it's not very useful, as case by case scenarios vary too wildly in terms of complexity and significance.