4 ms·
This is not possible under the npm/js paradigm of massive module dependency trees. You'll get a module and it will have 10 dependencies and each of those 10 de
by kevin_b_er 8y ago
This is not possible under the npm/js paradigm of massive module dependency trees. You'll get a module and it will have 10 dependencies and each of those 10 dependencies will each have 5 dependencies. Three of those at the 4th level was an infected eslint package.
They've learned precious little since left-pad.
- cphoover 8y agoRight! that's what I thought this is left-pad all over again. Although left-pad was really just a disgruntled publisher... this involves a malicious third party. My suggestion in fixing the later would be to enforce 2FA for publishing of packages that have so many dependents. Award a badge to a release when it is published with 2FA. So for LTS releases they can be verified as manually published. This will impact package consumers decision making process, on whether or not to include a dependency into their package.json.