Eleven lines of left-pad vanished from npm, and builds broke

transcript

Eleven lines of code disappeared. Builds started failing. Hundreds of failures a minute. Over a name.

A developer, Azer, has an npm package called kik. The messaging company Kik wants the name. npm's dispute policy says: give it to Kik. Then Azer unpublishes kik. And 272 other packages. No warning.

One of those packages was left-pad. It pads a string on the left. 22 March, 2:30 p.m. Pacific. Installs reach for it. Not found. npm sees hundreds of failures per minute.

Within ten minutes, another developer publishes a working copy. Version 1.0.0. But here's the catch. Babel pulls in a package called line-numbers. And line-numbers asks for exactly 0.0.3. Nothing else will do.

So npm does something it calls unprecedented. It puts the original back. Announced at 4:05. Done by 4:55. About two and a half hours of broken installs.

A week later, npm changes the rules. In its first 24 hours, a version can be unpublished freely. After that, npm support checks first. If removing it would break other installs, it stays.

Your build is only as available as its smallest dependency. Pin it. Cache it. Know what you really pull in.

Full story in the article.