News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by fault1 on Tuesday January 11, 2022 @02:10AM (#29888501)
yeah, it's just nobody reads every package in that file.

apps generated via create-react-app have more than 2000+ transitive dependencies.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by syshum on Tuesday January 11, 2022 @03:29AM (#29888990)
That is a design problem of npm and really the nodejs dev community in general.

They (you) are Blaming the dev because inherent design flaws in their development methodology.

People have been pointing out this problem with npm for years and years

[ Parent | on HN ]