4 ms·
The package that broke NPM (accidentally)
- chatmasta 3y agotl;dr we polluted the commons over the holidays, breaking a bunch of people's stuff for no reason other than our own entertainment, and created a bunch of work for people who had to purge our pollution from the commons when they came back online in January That said, it does seem crazy that a single package depending on `xyz:*` means that the publishers of `xyz` can't unpublish a release. In fact even if your package "really" depended on a specific version (not `*`) of `xyz`, it still seems unreasonable to forbid the `xyz` package from unpublishing, or even deleting their npm account entirely. Has anyone from npm communicated what (if any) the fix will be for this vulnerability vector?