When "Everything" Becomes Too Much: The npm Package Chaos of 2024 - Socket
Happy 2024, folks! Just when we thought we'd seen it all, an npm user named PatrickJS, aka gdi2290, threw us a curveball. He (along with a group of contributors) kicked off the year with a bang, launching a troll campaign that uploaded an npm package aptly named everything. This package, true to its name, depends on every other public npm package, creating millions of transitive dependencies.The Chaos UnleashedThe everything package and its 3,000+ sub-packages have caused a Denial of Service (DO...
Read more at socket.dev