Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

NPM’s original sin was making package installation and general management so painless that folks installed micro packages for everything. Can’t really fault the software for that.

The issue was, as you say, the introduction of ESM. It used to be that you required modules one way and one way only (yes there was AMD for advanced use cases, but it was an add-on), then people felt the need to “standardize” that, no we have this mess of ESM and CJS.



I don't see what's wrong with micropackages.


Massive attack surface. That's true as a security risk, but also as a dependency risk (eg. left-pad).


Review and pin your direct dependencies. With transitive dependencies it doesn't differ from trusting large dependencies in general.

The alternative to micropackages has significant downsides. Pulling in extra surface and rolling your own buggy implementations while waiting for some commitee to bikeshed years on the implementation.

Making the right thing easy rather than the wrong thing hard is a lot better approach.


If you don’t vendor your dependencies. Which is a poor practice that is commonly associated with NPM, but is by no means a requirement of the technology.


Especially if…, I should say. Even vendored dependencies are a risk as NPM commits the additional sin of allowing the act of pulling a package onto the local machine for inspection to execute arbitrary code in the form of “postinstall” hooks.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: