So yesterday morning I sat down with my coffee, pulled the latest on a side project, ran npm install, and got a wall of red text instead of a working build. My first thought was that I'd broken something myself, because that's usually a safe bet. Turns out it wasn't me. It was the entire JavaScript ecosystem having a very public meltdown over a package that is, and I am not exaggerating, eleven lines of code.
The package is called left-pad. If you don't touch npm for a living this will sound insane, and honestly it kind of is. All it does is pad a string with characters until it hits a certain length — like turning "5" into "05". That's it. That's the whole module. A junior dev could write it in a coffee break, and a lot of people did in fact spend yesterday afternoon writing their own version of it just to unbreak their pipelines.
What happened is a guy named Azer Koçulu, who published a bunch of small npm packages, got into a dispute with npm Inc. over the name of one of his other packages (something called kik, which apparently conflicted with the messaging app Kik). npm sided with the company and reassigned the package name. Azer's response was to pull every single package he'd ever published from the registry, all at once, in protest. left-pad was one of them.
Normally that would be a shrug-worthy story about one guy being annoyed at a corporate decision. Except left-pad wasn't some obscure thing nobody used. It was a dependency of a dependency of a dependency for what feels like half the tools web developers touch every day: Babel, several React tooling chains, a pile of build scripts, you name it. Because npm packages can depend on other npm packages which depend on other npm packages, pulling one tiny brick out of the bottom of that tower took a bunch of very large, very important projects down with it. Builds started failing across the world within a couple hours, and nobody could figure out why until people started tracing it back.
I want to be annoyed at Azer here and honestly I'm not, not really. If anything the whole thing made me annoyed at the way we build software now. We've gotten into this habit of pulling in a package for absolutely anything, even something you could write yourself in about ninety seconds, because it's easier to npm install than to type eleven lines. Convenient right up until the guy who wrote those eleven lines decides he's had enough and hits delete, and suddenly your production deploy is broken because of a dependency three layers removed from anything you actually chose on purpose. I don't think most people using left-pad even knew they were using it.
npm eventually did something they apparently don't normally do, which is un-delete the package and restore it under some kind of new policy so this can't happen again quite so easily. Good. But it doesn't really fix the underlying thing, which is that a lot of modern JavaScript projects are basically towers of cards held up by strangers on the internet who owe you nothing and can walk away whenever they feel like it. That's not a knock on any of those people, by the way — nobody signs up to maintain a free package forever just because your company's build depends on it. That's on us for building it that way.
Anyway. I spent about forty minutes yesterday afternoon just deleting node_modules and reinstalling every twenty minutes hoping it had resolved itself, which, credit where it's due, eventually it had. Small silver lining: I now understand my own dependency tree a lot better than I did on Monday, because I actually went and looked at it for the first time in months. Turns out I had over 400 packages installed for a project that, if you squint, does maybe six things. That's its own kind of ridiculous and I'm not sure eleven-line left-pad is really the villain of this story so much as a symptom.
Apple had their event this week too with the new smaller iPhone, which I'm sure every other blog on the internet is covering today, so I'll leave that alone. This felt like the more interesting story anyway, less flashy, way more chaotic if you were actually trying to get work done yesterday.