When you (in Facebook's words) "Set up a modern web app by running one command", this is what happens: npm.anvaka.com/#/view/2d/rea…
4
69
14
110
The great LeftPad crash of 2016 proved that this much inter-connectivity has its detriments.
1
2
And that wasn't even done with malintent. Imagine the attack surface an actual bad actor has access to.
I think there are some ways to mitigate this, but all it takes is one junior developer adding a date picker component that includes a key logger and all bets are off. I don't think it will hit FAANG, it will hit somewhere with worse code quality control.
I think practically all platforms have the problem of unmanaged, unaudited external dependencies. Node and NPM are just so particularly easy to make fun off

Jan 10, 2020 · 6:13 PM UTC

1
1
Replying to @stilkov @mikekelly85 @kattkieru @shachaf
In general I think everyone still has an outdated "if it's in a repo I can trust it" attitude, but npm is the biggest package manager of the GitHub free-love era and so embraces it even more than the others.