Eleven lines of left-pad vanished from npm, and builds broke across JavaScript.

npm is the registry JavaScript projects download their building blocks from. When a project installs one package, it also pulls in everything that package depends on, and everything those depend on, and so on down the chain.

In March 2016, the messaging company Kik asked npm for help with a dispute: a developer, Azer, had a package called kik, and Kik wanted the name. Under its dispute policy, npm decided the name "ought to be maintained by Kik". Then, as npm's post puts it, "without warning to developers of dependent projects, Azer unpublished his kik package and 272 other packages".

One of them was left-pad. Version 0.0.3 is 11 lines of code: it adds spaces (or another character) to the left of a string until it's long enough. npm said its removal "impacted many thousands of projects".

Shortly after 2:30 p.m. Pacific on Tuesday 22 March, npm saw "hundreds of failures per minute". Installs that needed left-pad could no longer download it.

Within ten minutes, another developer, Cameron Westland, published a functionally identical left-pad as version 1.0.0. Many errors continued: popular chains, including Babel and Atom, pulled left-pad in through a package called line-numbers, which asked for exactly 0.0.3.

So npm took what it called "the unprecedented step" of putting the original 0.0.3 back. It announced the plan at 4:05 p.m. and finished by 4:55 p.m.

A week later, npm changed the rules. A version can be unpublished freely only in its first 24 hours. After that, npm support checks first, and if removing it "would break any other installs", it stays.

Why it matters: Your system is only as available as its smallest dependency. Pin and cache what you depend on (a private mirror or lock file), and know which tiny packages your build really pulls in.