4 ms·
Looks absolutely insane to me too. Recently I had to deal with a NPM-based theme for a minor website. It downloaded 140 dependencies. Most of them were trivial
by mopsi 3y ago
Looks absolutely insane to me too. Recently I had to deal with a NPM-based theme for a minor website. It downloaded 140 dependencies. Most of them were trivial like "string-width", which finds the visual width of a character (some Unicode characters may appear as double-width). The package consists of a rather simple 25-line function that tests a character against several if-s in a loop. A function that trivial does not justify adding +1 to the potential sources of supply-chain attacks.
- dboreham 3y agoUnfortunately JS people believe this is a feature not a bug.
- qwertox 3y agohttps://www.npmjs.com/package/is-odd https://www.npmjs.com/package/is-odd It's stuff like this which makes me hate npm and the modern Javascript ecosystem in general. You start a new project and pull in a bigger thing like Quasar and npm fetches hundreds of packages and the summary tells you that 5 of them have vulnerabilities in them before you even get started. What am I supposed to do with them? But regarding the string-width problem, im not sure if you've come across "What every developer should know about Unicode" [0], because it appears to be a problem which requires an external package. [0] https://news.ycombinator.com/item?id=37735801 https://news.ycombinator.com/item?id=37735801
- text0404 3y agothis is hardly restricted to the javascript ecosystem. it's a problem with any language where third-party libraries are readily available.