One dev, one naming fight
Quick version: a startup wanted the npm name kik. A dev named Azer already had it. npm handed the name to the company's lawyers. Azer was not having it, so he unpublished every package he'd ever pushed. All 273 of them.
Most? Nobody noticed. One of them? Oh, people noticed.
Here's the whole thing. Go ahead, run it.
The package was left-pad. All it does is stick characters on the front of a string. That's the entire library. Mess with the inputs and hit run, this is the actual code:
Eleven lines. Babel, React, webpack, and Node all leaned on this, usually without knowing it.
Then it just disappeared
The instant left-pad got unpublished, this is what devs everywhere started seeing. Same error, same minute, all over the planet:
Red CI as far as the eye could see.
It wasn't just the people who used it
Here's the thing that made it ugly. It hit everyone who used something that used something that used left-pad. Transitive dependencies. Hit the button and pull the brick out:
npm broke its own rules to stop it
To kill the bleeding, npm did something it had never done before: it un-unpublished left-pad. Restored a stranger's package without asking him. Builds went green. But it left a much bigger question sitting there.
I will not let a company take over a package I authored.Azer Koçulu, on why he pulled everything
where it played out
You don't actually own your dependencies
Look, the lesson isn't "Azer bad" or "npm bad." It's simpler and more uncomfortable: your app is a tower of strangers' code, and any brick in it can get yanked out from under you on a Tuesday.
So, practically: commit your lockfiles, vendor the stuff you genuinely can't lose, and maybe, just once, actually look at what npm install drags in. left-pad is fixed. The tower didn't get any shorter.