News for hackers. Stuff that matters.
Re:NPM Vulnerability Discussion on Twitter by ratww on Tuesday May 10, 2022 @02:28PM (#31330657)
The reason it is tolerated is because the philosophy of "thousands of small packages" has spread far and wide.

For every person calling it out like we're doing here, there are ten others praising maintainers able to whip ten semi-useless packages per week.

It's not just random maintainers making small packages. The core infrastructure of Javascript is in it. Babel is made of hundreds of packages, which all live on the same repository (because of course the maintainers don't want the hassle of maintaining multiple things). Some of those packages don't even have anything of importance in it, just metadata, a couple flags and some boilerplate [1]. The package is just a way of organizing code. Webpack, ESLint and others aren't exactly better.

EDIT: And of course I got downvoted :)

[1] https://github.com/babel/babel/blob/main/packages/babel-plug...

Re:NPM Vulnerability Discussion on Twitter by cxr on Tuesday May 10, 2022 @03:17PM (#31331358)
You're tacitly giving the people you despise leverage when you say things like:

> The core infrastructure of Javascript is in it. Babel[...]

Babel is not core JS infrastructure. It may be close to fundamental to the modern NodeJS development experience, but JS exists happily (and capably) without any of that stuff (including package.json, for that matter).

Re:NPM Vulnerability Discussion on Twitter by ratww on Tuesday May 10, 2022 @04:40PM (#31332394)
Fair enough! True, Babel is only "core" for a subset of JS developers, not for the language.

I don't really despise anyone in Babel, though, I'm only criticising their packaging method. Babel isn't doing the million-packages thing to gain popularity.