261–270 of 520 posts
> Update - Most of the deleted packages have been restored and installation of those packages should succeed. Nine packages are still in the process of restoration. > Jan 6, 20:12 UTC https://status.npmjs.org/incidents/41zfb8qpvrdj
Earlier quoted context omitted.
Can you link me to the incident where a person deleted their packages and broke Babel? I'd love to read about it. Edit: grammar
https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ left-pad was a package to, you guessed it, pad a string with n leading characters. Personally, I've always just written my own 2 line function for it (something like `function pad(s, n, ch) { return new Array(n - s.length).fill(ch).join("") + s; }`), but a bunch of packages either directly or indirectly depended on this left-pad package, so they all broke.
Earlier quoted context omitted.
Does not work as soon as you use node modules that come with native components that have to be recompiled for the machine, and there are many of these. Colleagues have been bitten by this - one used OS X 10.11, the other 10.12, and they experienced weird bugs from this. Went away once they kicked out node_modules from git.
Yeah, it’s an annoying problem. Maybe you could gitignore the *.node (the native module file extension) files only. But I’m not sure how you’d rebuild those “on demand” after a checkout without running 'npm install' from the top level.
Earlier quoted context omitted.
Detailed description what you could do with a malicious npm package is currently on he front page: "Harvesting credit card numbers and passwords from websites" https://news.ycombinator.com/item?id=16084575
am I the only one who thinks this could be more than a coincidence?
Earlier quoted context omitted.
Whaaa...? I swear I used `npm unpublish` several times in the past year. Yeah, it definitely exists: https://docs.npmjs.com/cli/unpublish
Only for a version less than 24 hours old. You can no longer remove established packages. A quote from the documentation page you linked: > With the default registry (registry.npmjs.org), unpublish is only allowed with versions published in the last 24 hours. If you are trying to unpublish a version published longer ago than that, contact support@npmjs.com.
Apparently, someone can remove established packages.
This may be a stupid question - I'm not that familiar with NPM or modern javascript development so forgive me, but does it not allow storing your dependencies locally? Is that not considered best practice? Just download your entire dependency tree and don't touch it unless you have to. It seems to me that if packages "disappear" from upstream, it shouldn't have any effect other than preventing an update due to the mi…
It does store them locally. I think the problems here are: - The missing packages can be replaced by someone who wasn't the original package author (e.g. a malicious hacker) - It's not easy to catch this ^^^ because NPM doesn't have support for signing versions in your project's dependency configuration... (I bet it will after this.) - Almost every modern website has a dependency on NPM somewhere in their build chain…
Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored: https://status.npmjs.org/incidents/41zfb8qpvrdj
Earlier quoted context omitted.
It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.
I take it that you've never had to work at a big organization? When you have multiple teams in different offices, it's incredibly difficult to constantly "herd cats" and point everyone to $latest_fad. And when you DO by some miracle get everyone (devs and management) to switch to $latest_fad, it's a huge pain to go back through and bug test/change every process to accommodate the new software. I don't think "people s…
Independent teams providing business capabilities through APIs would mostly eliminate the need to keep consistent technologies as long as the interface design follows shared guidelines.