News for hackers. Stuff that matters.
Re:70% of new NPM packages in last 6 months were spam by 3np on Wednesday August 07, 2024 @08:27PM (#41186914)
> Registry data is immutable, meaning once published, a package cannot change. We do this for reasons of security and stability of the users who depend on those packages. So if you've ever published a package called "bob" at version 1.1.0, no other package can ever be published with that name at that version. This is true even if that package is unpublished.

This statement makes assertions and sets expectations for both publishers and users. It would be senseless if npmjs would start arbitrarily "taking down" packages on their own discretion simply because they include a tea.yaml file (as proposed in the comment I replied to).

There are no comments on this comment yet.