Re:Self Propagating NPM Malware Compromises over 40 Packages
by chamomeal on Tuesday September 16, 2025 @11:01AM
(#45263264)
When I was learning JS/node/npm as a total programming newbie, a lot of the advice online was basically “if you write your own version of foobar when foobar is already available as an npm package, you’re stupid for wasting your time”.
I’d never worked in any other ecosystem, and I wish I realized that advice was specific to JS culture
Re:Self Propagating NPM Malware Compromises over 40 Packages
by jlarocco on Tuesday September 16, 2025 @11:53AM
(#45263944)
It's not really bad advice, it just has different implications in Javascript.
In other languages, you'd have a few dependencies on larger libraries providing related functionality, where the Javascript culture is to use a bunch of tiny libraries to give the same functionality.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by lenerdenator on Tuesday September 16, 2025 @12:03PM
(#45264086)
Sometimes I wonder how many of these tiny libraries are just the result of an attempt to have something ready for a conference talk and no one had the courage to say "Uh, Chris, that already exists, and the world doesn't need your different approach on it."
Re:Self Propagating NPM Malware Compromises over 40 Packages
by user34283 on Wednesday September 17, 2025 @06:34AM
(#45274064)
It's a waste of time to strictly vet dependencies on my side when adding the standard test runner by Meta - jest - alone adds 300 packages to my dependency graph.
So yes, the sprawling deps tree and culture is the problem. We would need to start reducing dependencies of the basic tools first. Otherwise it seems rather pointless to bother app developers with reducing dependencies.
> You can't expect people to re-write everything over and over.
That’s the excuse everyone is giving, then you see thousands of terminal libraries and calendar pickers.