Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

211–220 of 520 posts

Re: Many packages suddenly disappeared

#211

Post by djsumdog »

xxkylexx wrote: post #27

> Update - Most of the deleted packages have been restored and installation of those packages should succeed. Nine packages are still in the process of restoration. > Jan 6, 20:12 UTC https://status.npmjs.org/incidents/41zfb8qpvrdj

From the Github issue:

> Beginning at 18:36 GMT today, 106 packages were made unavailable from the registry. 97 of them were restored immediately. Unfortunately, people published over 9 of them, causing delays in the restoration of those 9. We are continuing to clean up the overpublications. All installations that depend on the 106 packages should now be working.

Hard to believe less than a hundred packages cause so many issues. NPM's dependency hierarchy is pretty insane.

Re: Many packages suddenly disappeared

#212

Post by kstenerud »

paultopia wrote: post #184

Stupid question from non-pro here: everyone's always like "never commit libraries into source control." But, um, this kinda thing?

Don't store libraries in your project's repository. It bloats things like hell and makes it difficult to navigate the change sets. Set up your own library cache. Store that cache in its own repo if that floats your boat. Then all of your projects can get their dependencies from your cache.

Re: Many packages suddenly disappeared

#213

Post by fcarraldo »

notamy wrote: post #137
fcarraldo wrote: post #110

Earlier quoted context omitted.

yarn does local caching in developer laptops. What GP is referring to is having an on-prem private dependency server which acts as a cache and proxy to the centralized public dependency repo.

> an on-peen private dependency server SURELY you meant on-prem, right?

yikes! yes, fixed. my default autocorrect language is not English, so I’ll just blame that.

Re: Many packages suddenly disappeared

#214

Post by gsich »

Kudos wrote: post #148
notatoad wrote: post #96

Earlier quoted context omitted.

seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.

The term "nazi" is not simply mildly offensive, there are likely legal implications if you want to serve users in Germany.

Even if (which it doesn't, the term is not forbidden), why should npm care?

Re: Many packages suddenly disappeared

#215

Post by 0x0 »

ben_jones wrote: post #127

module.exports = typeof Promise === 'function' ? Promise : require('pinkie'); I can't even install webpack-dev-server. Because this package is missing. EDIT: it's back [1]: https://stackoverflow.com/questions/48131550/nodemon-install... [2]: https://github.com/npm/registry/issues/255

But it's published by "puradox", not by "floatdrop"!

Re: Many packages suddenly disappeared

#216

Post by badsectoracula »

newfoundglory wrote: post #178
badsectoracula wrote: post #157

Earlier quoted context omitted.

> New Geometry Representation might be a fine name for a new format, but you're not going to use its acronym. I might... the acronym doesn't ring any bells and a Google search doesn't show anything special (if anything, it already shows a bunch of other things - including companies and organizations - using the same letters). What is the issue?

I think they are imagining people trying to pronounce the acronyms ngr and fgt and getting offensive words out of them. I don’t think that would have occurred to me.

If you didn't mention the "getting offensive words" part it wouldn't even cross my mind as i'd pronounce NGR as En-Gee-Ar :-P.

Re: Many packages suddenly disappeared

#217

Post by dmitriid »

krzyk wrote: post #26

So they didn't learn anything from left-pad situation from 1.5 year ago? Packages that are published should be immutable, just like in maven repo case.

They sweared this would never happen again.

Then it happened again not two months after left-pad. And now it happened again.

Re: Many packages suddenly disappeared

#218

Post by dmitriid »

ris wrote: post #52
JepZ wrote: post #44

Btw. for those who don't know: Yarn (which is an alternative to npm) uses a global cache [1] on your machine which speeds things up, but probably also protects you from immediate problems in cases like the one currently on progress (because you would probably have a local copy of e.g. require-from-string available). [1] https://yarnpkg.com/lang/en/docs/cli/cache/

Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...

Yarn was the only thing that made npm get off their collective asses and do something about their dog-slow issue-ridden CLI and services.

Re: Many packages suddenly disappeared

#219

Post by fiatjaf »

j3097736 wrote: post #116
fiatjaf wrote: post #103

Earlier quoted context omitted.

Your idea is awful, but you really shouldn't be downvoted. It is better to use content hashes and a system that distributes and enforces these, like IPFS. Someone could just create some hooks for https://github.com/whyrusleeping/gx and we would have it done.

Already done https://github.com/diasdavid/npm-on-ipfs tough it doesn't seem to be mantained anymore.

No. That's not what I'm talking about. That's just a way to host your own snapshot of the entire npm registry. Not a good way to introduce the decentralization feature of IPFS.

Re: Many packages suddenly disappeared

#220

Post by dmitriid »

throwaway66666 wrote: post #37

I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me. In my company we take the stable version of the library we want to use and we self-host it. We basically have added a cache that we manage and cont…

Setting an internal mirror for a registry is often a hassle quite a few companies cannot afford, as it adds more operational burden/costs.
Post reply on HN