3 ms·

That yet another NPM package proves to be pretty broken seems to be par for the course, but what especially shocks me is that on Hackerone the people working on

That yet another NPM package proves to be pretty broken seems to be par for the course, but what especially shocks me is that on Hackerone the people working on this vulnerability can't reach the original maintainer and then say: "Doesn't look epic to me, also last publish was 3 years ago." It doesn't look epic, yet it's a package that has over 1.2 million weekly downloads. Also, fun fact, one of the dependent packages is react-input-select...WHY?

00oo00 8y ago
Checkout react-input-select's package.json... It's just full of unrelated random dependencies. Might be some way to advertise his node package?
wolfgang42 8y ago
react-input-select has 640 (!) dependencies, all of which were added by the author in a commit named 'type fix'[1] which seems to have been ostensibly intended to fix a typo, and none of which seem to be required to actually use the library. The only thing I can imagine is that the author somehow added their entire node_modules tree as dependencies. Maybe it was an ill-fated attempt at pinning? [1]: https://github.com/rayescmata/react-input-select/commit/cd7b82578d70b9562013e00eb1ee7594ef628e9d https://github.com/rayescmata/react-input-select/commit/cd7b...