Re:Self Propagating NPM Malware Compromises over 40 Packages
by johnny22 on Tuesday September 16, 2025 @10:46PM
(#45271031)
Last i checked react's new compiler still depends on babel! :(
Re:Self Propagating NPM Malware Compromises over 40 Packages
by WorldMaker on Wednesday September 17, 2025 @12:34PM
(#45278070)
Yeah, I still don't understand a lot of the architecture choices behind the new compiler, including why the new compiler isn't mostly just a set of eslint suggestions with auto-fixes. I've seen the blog posts trying to explain it, but they don't seem to answer my questions. But then I also haven't done enough direct React work recently enough to have need of or actually tried to use the new compiler, so maybe I am just asking the wrong questions.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by user34283 on Wednesday September 17, 2025 @06:49AM
(#45274150)
Jest alone adds 300 packages by the way.
Re:Self Propagating NPM Malware Compromises over 40 Packages
by WorldMaker on Wednesday September 17, 2025 @12:29PM
(#45277996)
Yep, which is part of why it feels real good to delete Jest and switch to `node --test`. I realize for a lot of projects that is easier said than done because Jest isn't just the test harness but the assertions framework (`node:assert/strict` isn't terrible; Chai is still a good low-dependency option for fancier styles of assertions) and mocks/substitutes framework (I'm sure there are options there; I never liked Jest's style of mocks so I don't have a recommendation handy).
(ETA: Also, you may not need much for a mocks library because JS' Proxy meta-object isn't that hard to work with directly.)
- Axios and Jest have "native" options now (fetch and node --test). fetch is especially nice because it is the same API in the browser and in Node (and Deno and Bun).
- Redux is self-contained.
- React itself is sort of self-contained, it's the massive ecosystem that makes React the most appealing that starts to drive dependency bloat. I can't speak to Svelte.