3 ms·

Unfortuntely, whilst npm is the largest source of packages, it's not the only place where this problem exists. Most programming languages have this issue to on

Unfortuntely, whilst npm is the largest source of packages, it's not the only place where this problem exists. Most programming languages have this issue to one degree or another, which is that they have a package management repository where there is no curation of content, and generally no package signing (there are some cases where that exists, but the take-up isn't always great). The challenge is that this now seems to be embedded in the culture of a lot of development, and changing that culture would be very challenging, I'd imagine.

kevin_b_er 8y ago
Yes. The fast moving package management dependency hell seems to be spreading, but I believe its root comes from npm/javascript. If we see it elsewhere it is because it is borrowed from javascript as it was seen as "the future" of software development.
- pcwalton 8y ago
  The concept of code sharing—which is a good thing, this incident notwithstanding—goes all the way back to CPAN and Perl 5.
  - tomjakubowski 8y ago
    In case anyone is unfamiliar with Perl's version history like I was, Perl 5 and CPAN date to 1994.
  - dragonwriter 8y ago
    > The concept of code sharing—which is a good thing, this incident notwithstanding—goes all the way back to CPAN and Perl 5. The concept is significantly older, but the implementation of a systematic facility for it rather than more ad hoc mechanisms may date from then. (It's a lot harder to sneak in and use an exploit in books of source code used in the 1970s-80s, though; convenience comes with a price.)