News for hackers. Stuff that matters.
Re:GitLab discovers widespread NPM supply chain attack by louiskottmann on Friday November 28, 2025 @03:08AM (#46076595)
This is my take as well. I've never come accross a JS project where the built-in datastructures were exclusively used.

One package for lists, one for sorting, and down the rabbit hole you go.

Re:GitLab discovers widespread NPM supply chain attack by sensanaty on Friday November 28, 2025 @06:32AM (#46077716)
I think this is mostly historical baggage unfortunately. Every codebase I've ever worked in there was a huge push to only use native ES6 functionality, like Sets, Maps, all the Iterable methods etc., but there was still a large chunk of files that were written before these were standardized and widely used, so you get mixes of Lodash and a bunch of other cursed shit.

Refactoring these also isn't always trivial either, so it's a long journey to fully get rid of something like Lodash from an old project

Re:GitLab discovers widespread NPM supply chain attack by silverwind on Friday November 28, 2025 @09:23AM (#46078898)
This has improved recently. Packages like lodash were once popular but you can do most stuff with the standard library now. I think the only glaring exception is the lack of a deep equality function.