News for hackers. Stuff that matters.
Re:Malicious code in the purescript NPM installer by na85 on Sunday July 28, 2019 @09:14PM (#20550777)
It's an ecosystem full of reinventing the wheel. The most popular library, lodash, includes a reimplementation of a foreach loop for Pete's sake, for reasons passing understanding since it's part of the ecma spec.

JavaScript is just amateur hour, and these things are going to keep happening. It's pathological.

Re:Malicious code in the purescript NPM installer by rwbcxrz on Sunday July 28, 2019 @11:35PM (#20551345)
Which foreach are you talking about? Array.prototype.forEach, for...in loops, for...of loops?

The first only works with arrays and array-like objects.

The second works on objects and arrays, but it iterates over all enumerable properties, so you don't want really want to use it for arrays. It's also made a lot less useful because it only iterates over properties, not keys.

The third finally provides some sanity, but it's only been around since ES6. Before that, lodash's each method was the most reliable way to iterate over a collection, be it an object or an array.

Just because you don't know the reason for something doesn't mean there isn't one.

Re:Malicious code in the purescript NPM installer by runarberg on Monday July 29, 2019 @01:30AM (#20551739)
`for ... of` only iterate over objects that implement `Symbol.iterator`. Native objects don’t do that by default, so `_.forEach` is more useful the `for ... of` even if you are only targeting modern browsers and not compiling the code down to an earlier version of the spec.

That said, you can use `Object.keys`, `Object.values`, or `Object.entries` if you want to iterate over objects that don’t implement `Symbol.iterator`, so if you only need `_.forEach` there is no reason to pull in any libraries.

    Object.entries(object).forEach(([key, value]) => {
      // ...
    });
Re:Malicious code in the purescript NPM installer by inimino on Monday July 29, 2019 @08:48AM (#20554006)
> Array.prototype.forEach

Yes, this one. If the object is an Array. According to whatever test they are using for that.

Lodash includes a reimplementation of Array.prototype.forEach because mistakes were made. It also works on other objects because other mistakes were made.

We all make mistakes. But just because there is a reason for something does not mean there is a good reason.