<story><title>NPM CEO Bryan Bogensberger Resigned</title><url>https://www.prnewswire.com/news-releases/npm-inc-announces-leadership-change-300922517.html?tc=eml_cleartime</url></story><parent_chain><item><author>president</author><text>As someone who has no insight into the Node&amp;#x2F;NPM&amp;#x2F;JS world, how is this different from Python&amp;#x27;s PyPi, which I would think suffers the same issue?</text></item><item><author>knightofmars</author><text>Yes.  The Node ecosystem is a huge liability just waiting to happen.  Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies?  Especially under the circumstances where they&amp;#x27;ve been declared without an explicit version (&amp;gt;, &amp;gt;=, &amp;lt;, &amp;lt;=, ~, ^, 1.2.x, *).</text></item><item><author>asien</author><text>I’m fascinated by the fact that while node has become a new standard in the industry , and the project is receiving lots of supports from all sorts of companies ( IBM , Microsoft etc...) absolutely no discussion has been opened about how much at risk the JavaScript ecosystem actually is with « npm » and it’s weekly dramas&lt;p&gt;Not a month pass without something going wrong inside of inc, millions of developers are dependant on it but nothing seem to worry people...</text></item></parent_chain><comment><author>Bartweiss</author><text>Mechanically, I believe the main difference is that NPM corresponds to PyPi + pip; it&amp;#x27;s both registry and repository. PyPi is Python&amp;#x27;s official package repository and pip&amp;#x27;s default source, but it&amp;#x27;s not pip&amp;#x27;s &lt;i&gt;only&lt;/i&gt; possible source. If someone pulls code off PyPi, pip can still link to it elsewhere.&lt;p&gt;When the left-pad debacle [1] broke major packages, the triggering event was that NPM-the-registry took a module name away from a developer and gave it to a company (which held it as a trademark). He got mad and took all his code off NPM-the-repository, including left-pad. To settle the chaos, NPM had to restore the deleted code against the developer&amp;#x27;s wishes - even though his code was still available on GitHub.&lt;p&gt;Realistically, though, that would still cause some chaos and it doesn&amp;#x27;t seem to be the key difference. The more important differences are legal and practical.&lt;p&gt;npm, inc. is a private company, while PyPi (via Warehouse) and pip are both open-source and donation funded. Even if npm doesn&amp;#x27;t get up to anything malicious, they depend on keeping their registry and repository unified, and they&amp;#x27;re more likely to attract and buckle under trademark suits than PyPi.&lt;p&gt;Even more importantly, npm modules are &lt;i&gt;tiny&lt;/i&gt;. PyPi packages and Ruby gems may be single-purpose, but they usually do something which isn&amp;#x27;t completely trivial, and common functions like math libraries are built into larger packages. npm left-pad was 17 lines of string-padding code that almost anyone could write. Other modules are even sillier; isArray has millions of weekly downloads for what is effectively a &lt;i&gt;single line&lt;/i&gt; of code. Blank npm templates have tens of thousands of files loaded even before you start coding.[2] So fundamentally, a big part of the issue is just that node projects tend to pull in 10x or 100x more dependencies than most other projects.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theregister.co.uk&amp;#x2F;2016&amp;#x2F;03&amp;#x2F;23&amp;#x2F;npm_left_pad_chaos&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theregister.co.uk&amp;#x2F;2016&amp;#x2F;03&amp;#x2F;23&amp;#x2F;npm_left_pad_chaos&amp;#x2F;&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.davidhaney.io&amp;#x2F;npm-left-pad-have-we-forgotten-how-to-program&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.davidhaney.io&amp;#x2F;npm-left-pad-have-we-forgotten-how...&lt;/a&gt;</text></comment>
<story><title>NPM CEO Bryan Bogensberger Resigned</title><url>https://www.prnewswire.com/news-releases/npm-inc-announces-leadership-change-300922517.html?tc=eml_cleartime</url></story><parent_chain><item><author>president</author><text>As someone who has no insight into the Node&amp;#x2F;NPM&amp;#x2F;JS world, how is this different from Python&amp;#x27;s PyPi, which I would think suffers the same issue?</text></item><item><author>knightofmars</author><text>Yes.  The Node ecosystem is a huge liability just waiting to happen.  Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies?  Especially under the circumstances where they&amp;#x27;ve been declared without an explicit version (&amp;gt;, &amp;gt;=, &amp;lt;, &amp;lt;=, ~, ^, 1.2.x, *).</text></item><item><author>asien</author><text>I’m fascinated by the fact that while node has become a new standard in the industry , and the project is receiving lots of supports from all sorts of companies ( IBM , Microsoft etc...) absolutely no discussion has been opened about how much at risk the JavaScript ecosystem actually is with « npm » and it’s weekly dramas&lt;p&gt;Not a month pass without something going wrong inside of inc, millions of developers are dependant on it but nothing seem to worry people...</text></item></parent_chain><comment><author>josegonzalez</author><text>The number of packages you need to audit for what would otherwise seem to be a trivial feature is exponentially larger in JS world than in Python. A good example of that is the left-pad debacle, wherein a package that left-pads a string was taken down, causing other packages - notably React - to fail to be installed because of either direct or transitive dependencies.&lt;p&gt;In the Python world, it is indeed likely that unpublishing requests will cause issues, but the number of dependencies you&amp;#x27;d need to audit&amp;#x2F;vendor is _much_ smaller for a typical python app than it is for a typical nodejs app, so your &amp;quot;attack surface&amp;quot; is also comparatively much smaller.</text></comment>