3 ms·
'nmp'
by philipwhiuk 6mo ago
'nmp'
- INTPenis 6mo agoNode's Malicious Packages.
- animuchan 6mo ago"The Good Parts"
- krautsauer 6mo agoI only noticed at goat farming. But anyway, what would a left-justify package do?
- yk 6mo agoPull left-pad as dependency presumably.
- yellowapple 6mo agoWhich then, inexplicably, pulls left-justify as a recursive dependency.
- dasyatidprime 6mo agoThe dependency cycle is actually the functional mechanism of the code, because they subvert the dedup mechanism in the package manager using a random generation trick. Each recursive copy of the dependencies takes up a little bit more space, which ultimately gets converted to the spaces inserted into the original datum; the caller is expected to adjust the cache settings to signal the desired amount. That's also why if you're using left-justify to process strings, Yarn is recommended for best compatibility. /joke
- brazzy 6mo agoSo you're saying dependency resolution is Turing complete?
- animuchan 6mo agoThis is so beautifully cursed, reusing the module loader state as your local state. We could have the familiar Python syntax of `from <key> import <value>` And a custom import hook eating the error. To get value(s) for a given key, naturally we'd scan the module loader cache. Elegant.
- smsm42 6mo agoSame as left-pad (https://en.wikipedia.org/wiki/Npm_left-pad_incident https://en.wikipedia.org/wiki/Npm_left-pad_incident) but much better?
- swiftcoder 6mo ago> I only noticed at goat farming Heh. I didn't even blink at that. I know a couple of open-source folks who actually packed up to buy off-grid farms in Portugal