One liner NPM package “is-windows” has 2.5M dependants, why on earth?

Re:One liner NPM package “is-windows” has 2.5M dependants, w... by stupidcar on Wednesday June 19, 2019 @10:08AM (#20223472)

I think it's funny how so many people have an allergic reaction to using a package manager to add fragments of small but non-obvious code to their codebase, but have no issue with frequently using Google to track down one-liners on Stack Overflow, which they then copy-and-paste into their codebase.

Why is you acting like a slow, biological package manager for small bits of code better than using a real package manager for the same purpose?

[ Parent | on HN ]

Re:One liner NPM package “is-windows” has 2.5M dependants, w... by tntn on Wednesday June 19, 2019 @10:18AM (#20223568)

1. The code you pull in will not get updated unless you do it explicitly.

2. The code you pull in will not get exploited when someone masquerades as the package owner. (How many widely publicized cases of this have there been by now, 5? 10?)

3. Presumably you read the code enough while copy-pasting to be sure it isn't mining Bitcoin or something.

[ Parent | on HN ]

Re:One liner NPM package “is-windows” has 2.5M dependants, w... by gnrl on Wednesday June 19, 2019 @10:19AM (#20223582)

The line of code in that moment is read and "vetted". Same can be done for the dependency yes, but what happens if malicious code is injected later and you update your packages? Or like the leftpad disaster where the package was deleted?

There is many reasons why the copied one liner is better and many why the package manager is better.

[ Parent | on HN ]