Hacker News Reader

Comment by MyFirstSass | Hacker News Reader

Seriously fuck this dude leeching on the open source community.

He's not even a technical guy but has a background i marketing and is directly trolling various Github issues :

https://news.ycombinator.com/item?id=28661094

I've always wondered why node-modules and npm required such an insane amount packages so quickly, and now i know why, people like him that use their 10.000 ridiculous packages to boost their career or do whatever self serving community destroying thing they can think off that day.

There really should be a way to ban people doing this shit.

View on HN

It's more a statement about the community than him imo. Or maybe about what npm allows to be published. Nobody forced you to use is-odd, yet it's downloaded 200k a week, why? Because js' developer community doesn't know any better

Exactly right. Its clever way of deflecting blame that whole community should share by piling on this particular person.

This really sounds like victim-blaming. The community is vulnerable to somebody publishing asinine modules, which should be addressed. However, this individual is still the perpetrator.

A lot or these downloads may be CI systems running automatic tests.

They clearly are, but this still means a not negligible amount of softwares have those packages in their dependencies.

Maybe someone needs to do a website in the same spirit of https://youmightnotneedjquery.com except youmightnotneedjonschlinkert.

Notice that most dependents of his tools are: 1) his own project, 2) abandoned beginner projects.

As some people mentioned, most of the usage of is-even is by tools made by this person.

But the other part is that, he made quite a few development tools for beginners that scaffold new projects and pull lots of his packages as dependencies (especially the handlebars helper), which heavily inflates the number of "Dependents" in NPM.

The other issue is that, in the past, he managed to include some of his less-useless packages in some semi-popular tools.

Isn't the post you linked to about a different person?

I mostly write in languages without package managers so it is possible that my expectations are just wrong, but is there no way of showing your dependency graph when using npm?

Here are some popular ones. Now, in two of these cases, they can be dev-dependencies, but even there, it makes me angry, since all of those deps have to be downloaded to my machine, and can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox).

https://npm.anvaka.com/#/view/2d/jest

https://npm.anvaka.com/#/view/2d/tailwind

https://npm.anvaka.com/#/view/2d/aws-sdk

> can run any random code they want at install time (which is why Node projects should always be run in some kind of sandbox).

You can install with the --ignore-scripts flag. Or set the option globally in your npm config file.

> There really should be a way to ban people doing this shit.

???

There is. It's called "doing nothing."

It takes work to add a dependency to your project; they don't spring out of nothing.

The author hasn't forced you to import their package. What's there to ban apart from maybe polluting the common namespace?

Reply on news.ycombinator.com