Hacker News Reader

Comment by yladiz | Hacker News Reader

I don't remember the intricacies of NPM or Yarn, but don't one/both of them have resource integrity enabled, so that you know that the package that's being installed is the one in your lock file? If not, why isn't this a feature especially after the clusterfuck of the guy deleting all his packages back about two years ago, breaking tons of things including Babel and React?

This wouldn't fix the issue of someone deleting the actual package (this happened here?), but it would prevent some malicious code being installed if someone uses the same package name.

View on HN

Can you link me to the incident where a person deleted their packages and broke Babel? I'd love to read about it.

Edit: grammar

https://www.theverge.com/2016/3/24/11300840/how-an-irate-dev...

Thanks.

https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/

left-pad was a package to, you guessed it, pad a string with n leading characters. Personally, I've always just written my own 2 line function for it (something like `function pad(s, n, ch) { return new Array(n - s.length).fill(ch).join("") + s; }`), but a bunch of packages either directly or indirectly depended on this left-pad package, so they all broke.

Packages broke because of a literal two line function? That's hilarious and terrifying at the same time.

Well... No. the left-pad function is 11 lines. The source code, as it was back then, according to that register article, was like this:

function leftpad (str, len, ch) {

  str = String(str);

  var i = -1;

  if (!ch && ch !== 0) ch = ' ';

  len = len - str.length;

  while (++i < len) {
    str = ch + str;
  }

  return str;

}

But yes, packages broke because of what _could_ have been implemented in one line (ignoring the two lines for the function signature and closing curly).

Reply on news.ycombinator.com