When "Everything" Becomes Too Much: The npm Package Chaos of 2024 - Socket
socket.dev
An NPM user named PatrickJS launched a troll campaign with a package called "everything," which depends on all public npm packages.
  • FrameXX@discuss.tchncs.de
    6·
    9 months ago

    Isn’t this a problem with every package/library system? Is there really a solution to this that doesn’t limit packages with how they handle their dependencies?

    This may also be about trust. npm probably could limit a number of dependencies that a single package can have with an arbitrary limit, but they don’t do that, because they trust the developers they won’t misuse their options. Well…