Hacker News Reader

This may be a stupid question - I'm not that familiar with NPM or modern javascript development so forgive me, but does it not allow storing your dependencies locally? Is that not considered best practice? Just download your entire dependency tree and don't touch it unless you have to.

It seems to me that if packages "disappear" from upstream, it shouldn't have any effect other than preventing an update due to the missing dependency.

View on HN

It does store them locally. I think the problems here are:

- The missing packages can be replaced by someone who wasn't the original package author (e.g. a malicious hacker) - It's not easy to catch this ^^^ because NPM doesn't have support for signing versions in your project's dependency configuration... (I bet it will after this.) - Almost every modern website has a dependency on NPM somewhere in their build chain - NPM being down means loads of sites can't deploy properly

So yeah. This may be a really big deal.

It might be easier to catch if packages were namespaced by author and package name, or even directly by URL, the way Composer does with PHP dependencies. It's easier to spoof 'infinity-agent' than 'floatdrop/infinity-agent' or 'github:floatdrop/infinity-agent'

You can create a local offline mirror using the shrinkpack (not shrinkwrap) tool.

Reply on news.ycombinator.com