Hacker News Reader

Comment by jannes | Hacker News Reader

What disgusts me the most about the JS ecosystem these days is that even the most basic developer tools have tons of depencies.

Let's say you want to use webpack and TypeScript on a project: Boom. 425 packages installed. And that's before you have written a single line of code. (It's probably worth noting that the offender is webpack. TypeScript seems to be dependency-free.) [1]

Every single one of those 425 packages could have a malicious postinstall script that deletes your entire home directory or sends your private ssh keys to a remote server.

npm makes it too easy to add dependencies to a library.

[1]: If you also want webpack-cli that's another cool 441 packages for you.

View on HN

"Small package" culture is Code Reuse writ large.

Maybe Code Reuse is not the paradise the software industry has for so long thought it was?

This. Even with minimal applications your node_modules is so full of stuff that you need external tools for reviewing your dependency graph.

But TypeScript is a positive exception to this trend. It has no (npm) dependencies at all.

I remember trying to play a little with node and vue.js a few months ago (I'm a devops/backend developper by trade). Having seen the size of my node_modules directory, nearly 1GB, I was kind of horrified (to be fair, I checked most of the testing options, so a lot of the libraries were coming from that).

Developer tools are code like any other. Of course they should reuse existing code rather than reinventing the wheel.

Avoiding malicious postinstall scripts is a separate problem that needs to be solved whether you use dependencies for developer tools or not.

What are the exact downsides of having lots of small packages? Rather than a few big ones? I keep hearing that its a complaint, but not one instance of why it is actually a bad thing.

It's interesting to compare with JVM ecosystem, where each dependency can only have one version, and you get version collisions if multiple packages list different versions of the same sub-dependency. I feel there is more thought in adding sub-dependencies, while in the node ecosystem because you won't have collisions, devs don't really seem to care how much they add.

Reply on news.ycombinator.com