Re:Offical XRP NPM package has been compromised and key stea...
by poincaredisk on Tuesday April 22, 2025 @09:55AM
(#43762236)
The crazy part here is that in most other ecosystems 100 dependencies is "crazy high" territory, and in JS it's apparently "we're just getting started". It's known for its approach to micropackaging everything in a separate library.
[ Parent
| on HN ]
Re:Offical XRP NPM package has been compromised and key stea...
by greatgib on Tuesday April 22, 2025 @11:06AM
(#43763107)
The crazy thing is more that multiple versions of the same package could be installed as dependencies of dependencies...
They were thinking to be the cool kids supporting multiple versions and that the old way to do packaging, like debian and co that expects everyone to use the same version, was the old legacy fart way to do things.
Just, developers before were engineers first and so designed things well especially to avoid this situation of dependency hell and supply chain injection. But the web dev crowd decided to do "better" and now to have old problems as new problems...
Re:Offical XRP NPM package has been compromised and key stea...
by nailer on Tuesday April 22, 2025 @11:09AM
(#43763139)
npm design allows multiple versions of the same package if required, but deduplicates otherwise. It’s a smart design that more package managers should and will follow.
Smart developers spend their time working on original code rather than rewriting the wheel.