[jbd0]

I knew npm was a train wreck when I first used it years ago and it pulled in literally hundreds of dependencies for a simple app. I avoid anything that uses it like the plague.

[zachrip]

I can tell a lot about a dev by the fact that they single out npm/js for this supply chain issue.

[brobdingnagians]

Lots of languages ecosystems have this problem, but it is especially prominent in JS and lies on a spectrum. For comparison, in the C/C++ ecosystem it is prominent to have libraries advertising that they have zero dependencies and header only or one common major library like Boost.

[RUnconcerned]

What other language ecosystems have had this happen systematically? This isn't even the first time this month!

[cedws]

The JavaScript ecosystem has a major case of import-everything disease that acts as a catalyst for supply chain attacks. left-pad as one example of many.

[lithos]

Just more engineering leaning than you. Actual engineers have to analyze their supply chains, and so makes sense they would be baffled by NPM dependency trees that utterly normal projects grow into in the JavaScript ecosystem.

[hsbauauvhabzb]

That they’ve coded in more than one language?

[Aeolun]

I think it’s just that a lot of old men don’t like how popular it has become with script kiddies.

[epolanski]

"I knew you weren't a great engineer the moment you started pulling dependencies for a simple app"

You realize my point right? People are taught to not reinvent the wheel at work (mostly for good reasons) so that's what they do, me and you included.

You ain't gonna be bothered to write html and manual manipulation, the people that will give you libraries to do so won't be bothered reimplementing parsers and file watchers, file watcher writers won't be bothered reimplementing file system utils, file system utils developers won't be bothered reimplementing structured cloning or event loops, etc, etc.

I myself just the other day had the task of converting HTML to markdown, because I don't remember whether it was Jira or Github APIs that returns comments as HTML and despite it being mostly few hours of work that would get us 90% there everybody was in favor of pulling a dependency to do so (with its own dependencies) and thus further exposing our application to those risks.

[komali2]

Pause, you could write an HTML to markdown library in half a day? Like, 4 hours? Or 12? Either way damn

[oVerde]

So basically you live JavaScript free?

[Xelbair]

as much as i can yes.

I try to avoid JS, as it is a horrible language, by design. That does include TS, but it at least is useable, but barely - because it still tied to JS itself.

[shkkmo]

You can write javascript without using npm...

[Arch-TK]

I mean, it's hard to avoid indirectly using things that use npm, e.g. websites or whatever. But it's pretty easy to never have to run npm on your local machine, yes.