2 ms·
Yeah, good point. The reason NPM can have packages like left-pad is that it works so well. It's easy to publish a package, it's easy to find one, it's easy to i
by cwp 6y ago
Yeah, good point. The reason NPM can have packages like left-pad is that it works so well. It's easy to publish a package, it's easy to find one, it's easy to install and use a package. So sure, why NOT make a package for one function that you use all over the place?
There's a downside to all this, but ultimately it's to NPM's credit: the tools are so easy to use that people... use them.
- brundolf 6y agoI feel the need to mention, whenever leftpad comes up, that it's impossible for that incident to ever happen again. Packages can no longer be unpublished after a brief window (48 hours I think?), so if you lock to specific patch numbers your dependencies are effectively immutable
- wglb 6y agoHow you do reconcile this, then? https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...