Re:GitLab discovers widespread NPM supply chain attack
by sensanaty on Friday November 28, 2025 @06:32AM
(#46077716)
I think this is mostly historical baggage unfortunately. Every codebase I've ever worked in there was a huge push to only use native ES6 functionality, like Sets, Maps, all the Iterable methods etc., but there was still a large chunk of files that were written before these were standardized and widely used, so you get mixes of Lodash and a bunch of other cursed shit.
Refactoring these also isn't always trivial either, so it's a long journey to fully get rid of something like Lodash from an old project
Re:GitLab discovers widespread NPM supply chain attack
by silverwind on Friday November 28, 2025 @09:23AM
(#46078898)
This has improved recently. Packages like lodash were once popular but you can do most stuff with the standard library now. I think the only glaring exception is the lack of a deep equality function.
One package for lists, one for sorting, and down the rabbit hole you go.