3 ms·

I know very little about the npm ecosystem or how popular/ubiquitous the author's library is, but its weekly downloads on NPM seem very high? https://www.npmjs.

by danso 6y ago

I know very little about the npm ecosystem or how popular/ubiquitous the author's library is, but its weekly downloads on NPM seem very high? https://www.npmjs.com/package/safe-buffer https://www.npmjs.com/package/safe-buffer safe-buffer is currently at 45M weekly downloads with 1.3K dependents. By comparison, the 4 most depended on libaries have a much lower ratio of downloads to dependents: https://www.npmjs.com/browse/depended https://www.npmjs.com/browse/depended 1. lodash: 38M downloadsand 128K ependents 2. React: 9M / 64k 3. Chalk: 62M / 62K 4. Requests: 22M / 50K 5. commander: 50M / 48K I'm assuming safe-buffer has its ratio because c̶o̶r̶e̶ highly popular libraries already depend on it (and those c̶o̶r̶e̶ libraries, not safe-buffer js, are what other libraries list as dependencies). Because Switch system updates wouldn't be downloading from npm, right? edit: I was using "core" to refer to extremely popular/depended-on libraries – e.g. mysql/mongo/requests depending on safe-buffer – but that's obviously not the right usage in this context.

poyu 6y ago
You're right, lots of popular and official packages depends on this package. Not sure what you mean by "core libraries" though. This package is just a wrapper around the Nodejs Buffer module so people can use it in a safe manner due to API changes. https://www.npmjs.com/browse/depended/safe-buffer https://www.npmjs.com/browse/depended/safe-buffer
- danso 6y ago
  Thanks, I edited my sloppy use of "core". I meant extremely popular/fundamental external libraries.
tomxor 6y ago
Clarification for those unfamiliar with NPM: The weekly downloads on NPM do not indicate individual manual project installs. They include every download including automatically through `npm install` from package.json, and often further automation via CI tools (which is where the vast majority of download numbers come from on all npm packages). These amplify the numbers significantly. i.e While they are a proxy for popularity, it can only be used relatively.
- colejohnson66 6y ago
  How does yarn affect that number? AIUI, yarn caches the packages on your machine so if you create multiple tract projects (for example), it only downloads react and its dependencies once.

by danso 6y ago

poyu 6y ago

You're right, lots of popular and official packages depends on this package. Not sure what you mean by "core libraries" though. This package is just a wrapper around the Nodejs Buffer module so people can use it in a safe manner due to API changes. https://www.npmjs.com/browse/depended/safe-buffer https://www.npmjs.com/browse/depended/safe-buffer

danso 6y ago
Thanks, I edited my sloppy use of "core". I meant extremely popular/fundamental external libraries.

tomxor 6y ago

Clarification for those unfamiliar with NPM: The weekly downloads on NPM do not indicate individual manual project installs. They include every download including automatically through `npm install` from package.json, and often further automation via CI tools (which is where the vast majority of download numbers come from on all npm packages). These amplify the numbers significantly. i.e While they are a proxy for popularity, it can only be used relatively.

colejohnson66 6y ago
How does yarn affect that number? AIUI, yarn caches the packages on your machine so if you create multiple tract projects (for example), it only downloads react and its dependencies once.