3 ms·

I think that's really the issue here. It's not that these packages exist and aren't useful to less experienced devs or people new to JS just trying to get a tas

I think that's really the issue here. It's not that these packages exist and aren't useful to less experienced devs or people new to JS just trying to get a task done, it's these packages keep showing up in professional/enterprise apps and libraries. Those devs should already know how to do this stuff. It seems odd these projects would leave themselves vulnerable to supply chain attacks over something so trivial.

ElevenLathe 3y ago
Really? I'm not a JavaScript dev but this is pretty inscrutable. I think its totally reasonable for devs to expect not to have to do all this byzantine casting and comparisons just to find out if a variable contains a number. You're right in the sense that an experienced dev should know to vendor this or reimplement in code they control rather than downloading it every time they build, but the necessity of this library is more of a damnation of the JS stdlib than anything.