NPM package ‘ua-parser-JS’ with more than 7M weekly download is compromised

Re:NPM package ‘ua-parser-JS’ with more than 7M weekly downl... by godmode2019 on Saturday October 23, 2021 @12:40AM (#28965778)

This is what I don't like about JS world.

I started a project in react and it installed like 100+ random packages. I had to audit everyone, so silly not to have a standard library.

[ Parent | on HN ]

Re:NPM package ‘ua-parser-JS’ with more than 7M weekly downl... by ranguna on Saturday October 23, 2021 @03:10AM (#28966364)

You want a standard library for... React?

What about the people that like Vue or angular more than react?

[ Parent | on HN ]

Re:NPM package ‘ua-parser-JS’ with more than 7M weekly downl... by HamburgerEmoji on Saturday October 23, 2021 @03:31AM (#28966451)

I think the suggestion was that there's this crazy explosion of transitive dependencies because JS is not 'batteries included' with some standard library that covers quite a lot of what people want.

If there's no standard library, you have to include some libraries to do what you want. Those libraries had no standard library to depend on either, so they had to do the same thing you did. And so on.

[ Parent | on HN ]