> The left pad issue was kind of wild coming from the enterprise Java space. This may be a little off topic for this comment thread but this is a little misrep

> The left pad issue was kind of wild coming from the enterprise Java space. This may be a little off topic for this comment thread but this is a little misrepresentative. Hosted private repos for enterprise weren't exclusive to Java at the time of left pad - anyone doing enterprise node likely had one for npm too & were probably well prepared for the attack. Such enterprise setups are expensive though (or at least take a level of internal resources many companies don't invest in) leaving the vast majority exposed to both js & java supply chain attacks even today.