8 ms·
NPM package is-even has over 140k weekly downloads
- antihipocrat 2y agoWith so many developers using this package there must be a few here on HN. If anyone here has included this as a dependency I'd love to know the reasoning behind it.
- biwills 2y agoFrom the description of the repo on GitHub: > I created this in 2014, the year I learned how to program. All of the downloads are from an old version of https://github.com/micromatch/micromatch https://github.com/micromatch/micromatch.
- LtWorf 2y agoTo prove a point that download counters are useless I wrote this: https://pypi.org/project/pypular/ https://pypi.org/project/pypular/ Takes me about 7 minutes at home to trigger 1 million fake downloads. I want to use http2 to send less headers and be able to do that in less time.
- compressedgas 2y ago> download counters are useless Unless they apply some kind of filtering to discount requests from the same source. If each source address were to only count as a single download once per period and a period was 20 minutes, your million fake downloads if from a single source would be forced to not take 38 years rather than 7 minutes.
- LtWorf 2y agoThey would not. In most cases downloads come from a badly setup CI that re-downloads the same thing tens of thousands of times per day. It's incredibly common for them to come from the same source. It would make sense but ALL the project counters would go down by a lot.
- travisjungroth 2y agoYou can fake counts up but not down. I think it can make a decent measure of popularity where there’s disincentive to be popular (like pypi security). You can set a point where you’ll catch almost all the truly popular packages, plus a small portion of the non-popular. (Although, the ratio of true positive to false positive may be way off, that’s the nature of things with low prevalence).
- jayflux 2y agoA large bulk of those downloads are coming from downstream packages (handlebars-helpers), I don’t think developers are pulling this in directly.
- desmond1303 2y agoI honestly don't know what's worse; That this package exists, or that the implementation requires a dependency to `is-odd` and just does `return !isOdd(number)`
- kriops 2y agoIIRC it’s the same author, and designed this way to farm downloads.
- beardyw 2y agoFrom GitHub: "Several years ago, just before my 40th birthday, I switched careers from sales, marketing and consulting to learn how to program, with the goal of making the world a better place through code. Whether that means giving people access to information, the tools and technology to level the playing field with big corporations, or empowering people in impoverished regions to participate in the world economy. To date, I've created more than 1,000 open source projects in an effort to reach my goal. Open source software takes a lot of time to create and maintain, and millions of projects now depend on my code. You can help me to achieve my goals of improving the world through code, help me create better developer experiences, or just say "thank you" by sponsoring me on GitHub. Any and all contributions are greatly appreciated."
- RockRobotRock 2y agoThe author is notorious for flooding npm with small packages like this.
- aprilnya 2y agoThis is wonderful
- darepublic 2y ago> (This project's readme.md is generated by verb, please don't edit the readme directly. Any changes to the readme must be made in the .verb.md readme template.) What's worse is that it comes with a special generated readme page.
- 2y ago
- tgdn 2y agois-odd [1] has even more weekly downloads (370k+) and is the only dependency of is-even [2]. [1]: https://www.npmjs.com/package/is-odd https://www.npmjs.com/package/is-odd [2]: https://github.com/i-voted-for-trump/is-even/blob/585f8002bb16f7bec723a47349b67df451f1b25d/index.js#L13 https://github.com/i-voted-for-trump/is-even/blob/585f8002bb...
- AdamN 2y agoThat's odd
- yard2010 2y agoIt's even called odd, what a coincidence
- trimethylpurine 2y agoCoincidences are verified using the == operator, independent of the is-odd package.
- ekianjo 2y agois-odd has over 350K weekly downloads... https://www.npmjs.com/package/is-odd https://www.npmjs.com/package/is-odd
- deleted 2y ago[deleted]
- Brajeshwar 2y agoAnd the source repository was archived in 2019.
- yoavm 2y agothis just must be a joke package, as all it is doing is importing an "is-odd" package and returning `!isOdd(i)`... sad to think that someone is actually using this though.
- dagw 2y agoAccording to the readme it was a package he created back in 2014 when first learning programming and wanted to work out how to create JS packages, and then it somehow exploded and took on a life of its own.
- r-spaghetti 2y agoIt even depends on is-odd (375K weekly downloads). The script kiddies have taken over.
- jjcm 2y agoWhich in itself depends on is-number (66M weekly downloads). The beautiful journey seems to end there. https://www.npmjs.com/package/is-number https://www.npmjs.com/package/is-number
- jspash 2y agoWhich used to depend on the legendary `is-is` package. Apparently the maintainer is a certain B. Clinton.
- dagw 2y agoWow! there are almost 2500 packages on npm that depends on is-number. That's insane.
- Someone 2y agoCombining that with https://www.npmjs.com/package/is-string https://www.npmjs.com/package/is-string, you can have a JavaScript valid x for which isNumber(x) && isString(x) ⇒ isNumber is better named “can-be-used-as-a-number”. Also, I don’t know JavaScript well enough, but https://www.npmjs.com/package/isnumber https://www.npmjs.com/package/isnumber is different code from https://www.npmjs.com/package/is-number https://www.npmjs.com/package/is-number, but does it have different semantics? (https://www.npmjs.com/package/lodash.isnumber https://www.npmjs.com/package/lodash.isnumber is different, I think. It (rightfully, IMHO) thinks ∞ and NaN are numbers)
- warpech 2y agoHopefully is-odd does not depend on is-even
- joegibbs 2y agoIt actually depends on "is-number", which is a very useful package containing num => typeof num === "number" No joke.
- vkoskiv 2y agoAm I missing something here, why is a package even needed needed for this? Can you not evaluate `some_int % 2` in Javascript to check for this directly?
- XorNot 2y agoJavascripts habit of coercing values when you don't want it too would make this presumably a little suspect? Even so: I'd much rather in my code have a function doing exactly this, rather then peppering it all through my code anyway.
- lodovic 2y agoSure, but that doesn't justify an external dependency
- dagw 2y agoIt seems to be a culture things in the JS world. Packaging just 1 or 2 functions as its own separate package and using large chains of dependancies is just the way they do things. In most other languages, if this function existed, it would either be in the standard library or be a tiny part of a single number manipulating library with 100s of functions.
- purple-leafy 2y agoI’m going to create my magnum opus tonight “isZero” Which checks if a number is 0
- bhaney 2y agoYou're seven years too late, unfortunately https://www.npmjs.com/package/is-zero https://www.npmjs.com/package/is-zero
- Ekaros 2y agoThankfully https://www.npmjs.com/package/is-not-zero https://www.npmjs.com/package/is-not-zero is free I think? I have no NPM experience apart from wondering why some somewhat modules are not on github anymore...
- purple-leafy 2y agoDamn, in that case I may need to regress to: “is” Which just returns true for truthy values and false for falsely values
- SavageBeast 2y agoOh yeah, Imma do the most Hacker News I can think of and re-impl both packages in Rust. Better yet I might fire up PyTorch and develop some ML solution to recognize even/oddness. There really are more choices for this than I though at first.
- culebron21 2y agoAnd publish some NN solution on public repo like huggingface.co.
- SavageBeast 2y agoIf we're going to build any of these we're going to really need to do some testing too. That means we need a suitably reliable generator of numbers known to be positive or negative.
- anonzzzies 2y agoWhen it just appeared I thought it was a joke, but it seems people actually use this...
- Brajeshwar 2y agoQuite a while back, I once saw a front-end engineer copy-pasting every bit of the CSS that he wrote. So, I asked, “Won’t it be faster if you just typed?” “I want to avoid errors.”
- berkut 2y agoAnd is-odd depends on: https://www.npmjs.com/package/is-number https://www.npmjs.com/package/is-number
- jahnu 2y agoGlancing at GitHub it's primary use seems to be just to demonstrate how to use packages. https://github.com/search?q=require%28%27is-odd%27%29&type=code https://github.com/search?q=require%28%27is-odd%27%29&type=c...
- jongjong 2y agoWould be nice if npm differentiated direct downloads from indirect downloads as a dependency.
- peter_retief 2y agoMaybe a bit off topic but who is paying to host these services?
- hsn915 2y agoMicrosoft, as they have acquired both github and npm
- vsnf 2y agoDart has a lot of built-in methods similar to this. Yes, that includes `$n.isEven` and `$n.isOdd`. It's especially nice with iterables that have `.isEmpty` and `.isNotEmpty`. I make regular use of all four. It cuts down on clutter and makes the intent unmistakably clear. I think these JS packages, and Dart's inclusion of them in the stdlib are indicative of a clear need among programmers for unambiguous intention. Also, I suspect a lot of people, especially JS programmers, of whom a large percent is certainly made up of non-formally educated people, likely don't know that testing for even-ness can be done with modulo. All of this is to say, instead of this being an indictment of the JS ecosystem and its programmers, its more indicative of a stdlib function that should exist but doesn't.
- deleted 2y ago[deleted]
- OptionX 2y agoIs N%2==0 ambiguous for you?
- vsnf 2y agoTo me? No. But its extra characters that I need to scan and process, it's syntax that can't be autocompleted by my LSP/IDE, and it's at least one mental leap away from what I really want to do. I am interested in the even-ness, not the remainder. The simpler programming can be made to be, the better. I'm not going to die on the anti-modulo hill, I don't care that much about it. But I think it's silly to pretend that it's not overly complicated (even if only a little) for the task most commonly at hand.
- 2muchcoffeeman 2y ago>All of this is to say, instead of this being an indictment of the JS ecosystem and its programmers, its more indicative of a stdlib function that should exist but doesn't. Surely by now they would have recognised a need for some standard math packages and then created one and all the new projects should be using that and people would have migrated? Especially given how fast FE seems to move. Instead they are content with pulling a thousand dependencies and an intractable dependency system.
- bufferoverflow 2y agoIs there an easy way to trace the most popular packages that use it?
- jayflux 2y agoSadly not and I think this is an important question because I’m sure the majority of those downloads are coming from some downstream packages that everyone is using. Ordering and showing dependent-downloads would be useful in security issues when wanting to contact package authors who have the largest exposure to an exploited package. It was raised on npm’s feedback before, I don’t think they were interested in adding it. EDIT: the bulk of downloads appear to be from handlebars-helpers
- StayTrue 2y agoClick ‘Dependents’.
- jayflux 2y agoDependents doesn’t order by download count though, you don’t know which of the 46 dependents are downloading it the most.
- dagw 2y agoIn this case main culprit seems to be a package called handlebars-helpers which is a collection of utilities for working with the handlebars templating language which was pretty popular in the JS world for a while.
- 12_throw_away 2y agoTake a look at the author's github bio, the grift is pretty obvious: > I've created more than 1,000 open source projects in an effort to reach my goal. Open source software takes a lot of time to create and maintain, and millions of projects now depend on my code.
- xarope 2y agoThis probably is most telling: "I switched careers from sales, marketing and consulting". Having said which, if his intention was to use his skills in sales, marketing and consulting to achieve these results, he has certainly achieved it.
- pacifika 2y agoI don’t think the root logic it ultimately depends on is obvious: https://github.com/jonschlinkert/is-number/blob/master/index.js https://github.com/jonschlinkert/is-number/blob/master/index... And so this is a perfect abstraction to make something non- obvious obvious. The real question is why this shouldn’t be part of the interpreter? Yes the dependency on isOdd is needless, but is a red herring. Most commenters here didn’t look deep enough, sadly.
- aidos 2y agoHmmm, that's not what I'm seeing when all this is put together. isOdd coerces to a number using Math.abs, so the string checks in isNumber don't apply. function isOdd(value) { const n = Math.abs(value); if (!isNumber(n)) { throw new TypeError('expected a number'); } if (!Number.isInteger(n)) { throw new Error('expected an integer'); } if (!Number.isSafeInteger(n)) { throw new Error('value exceeds maximum safe integer'); } return (n % 2) === 1; } function isNumber(num) { if (typeof num === 'number') { return num - num === 0; } if (typeof num === 'string' && num.trim() !== '') { return Number.isFinite ? Number.isFinite(+num) : isFinite(+num); } return false; }
- hsn915 2y agoThe problem here is not npm or the package itself. The absurdity of 140k weekly downloads is a result of CI/CD practices. I'm probably in the minority here but I think npm and github should actively disallow (or atleast discourage by making it very uncomfortable) to re-download the same dependencies from the internet on every pull request.
- aragonite 2y agoJudging from this page (https://www.npmjs.com/browse/depended/is-even https://www.npmjs.com/browse/depended/is-even), it appears that many of its dependents are joke packages. For example: - is-is-even: checks if the passed function is is-even - is-odd-or-even: determines if a given number is odd or even. - is-ice-cream: Amazing lib to check if string contain your favorite ice cream flavor Probably the main reason it has so many downloads is that it's imported as a module (rather than integrated as a constituent function) by the author's popular handlebars-helpers library of utility functions. Imagine if underscore.js were to separate out first() as its own module. Then you'd have a similar situation.
- creshal 2y agoIt's astonishing how many people defend a clear lack of basic math knowledge.
- beardyw 2y agoTo be fair he says on GitHub: i-voted-for-trump This is a joke. You'll only see this org if you are attempting to troll me about repositories I created when I was learning to program. is-odd Public archive I created this in 2014, the year I learned how to program. All of the downloads are from an old version of https://github.com/micromatch/micromatch https://github.com/micromatch/micromatch.
- PlunderBunny 2y agoThere must be some interesting edge cases with the idea of certain numbers being even or odd. I’m not familiar with whether the underlying numeric types can accomodate these values in JavaScript, but off the top of my head - what does maths have to say about the idea of the even/odd-ness of infinity, not-a-number, imaginary numbers. And there’s always undefined too. I suppose what I’m getting at is whether the answers to these questions are consistent between different packages and languages.
- nrawe 2y agoA couple of thoughts on this one. I think it is worth putting this in its historic context. Most of this code was written at a nascent point in JS history where NPM packages could start to be shipped to the browser (i.e. the Browserify years). This was a pretty wild time but one of the concerns was about the amount of code being shipped to browsers (this is pre-tree shaking, which only really works with ESM). Additionally, the glaciation of the JS runtime and standard library at the time, alongside the NodeJS "Cambrian Expansion" of npm, meant lots of authors were working to build out packages that fixed these classes of deficiencies (another example being the now infamous left-pad). We saw the same thing about the same time in the PHP world with the MicroPHP manifest and Composer, and I believe there was cross-pollination of ideas between these two things. It is also worth noting that a decent proportion of people entering into the JS world at this time were more traditional HTML/CSS designers, maybe with some backend experience, but usually not engineers with a strong programming background (my experience, mileage may vary). Looking at the chain of dependencies, the underlying logic of `is-number` is both common enough and a big enough footgun for those particularly less experienced JS developers to warrant a module. And once you've got it, need to do something with it, and once you've got things depending on you, you can't take it down; and thus, a house of cards is built. Lastly, I think its worth keeping in mind that this also tracks with an industry shift to GitHub and an explosion in MIT Licensing/sharing in a world untarnished by the kinds of supply-chain attacks a good deal of us are now rightly worried about. We take it for granted now, but GitHub was a huge change to the way FOSS happens, and that facilitated this kind of repo building (free hosting, free publishing to NPM, sharing culture etc).