Pararise

Community Picks is a section on daily.dev where our community members share the most interesting and valuable content they've discovered online. From insightful articles to handy tools, every post is a gem curated by our dedicated coomunity. To contribute to Community Picks, you need to have at least 250 reputation points, ensuring that only active and trusted members can share their finds.

Community Picks

A developer broke Node, Babel, and thousands of projects by removing a popular module from NPM, causing widespread disruptions. The module was removed due to brand infringement claims. NPM took the unprecedented step of restoring the unpublished module to resolve the issue.

How one developer just broke Node, Babel and thousands of projects in 11 lines of JavaScript

Updated to add at 1138 PT (1838 UTC) on March 23

Sumirized by GPT 4 :
This article describes a major disruption in the JavaScript programming community caused by the actions of a developer named Azer Koçulu. Here’s a summary:
<ul>
<li>
Incident: Developer Azer Koçulu unpublished over 250 of his modules from NPM (Node Package Manager), a crucial tool used for managing JavaScript dependencies.
</li>
<li>
Trigger: The dispute started over a module named “Kik,” which shared its name with an instant-messaging app. Kik’s legal team asked Koçulu to rename his module due to brand infringement. When he refused, they approached NPM’s administrators, leading to the module’s removal.
</li>
<li>
Reaction: Upset by NPM’s decision, Koçulu removed all his modules from NPM. This action was a protest against what he perceived as NPM favoring corporate interests over individual developers.
</li>
<li>
Impact: One of the unpublished modules was “left-pad,” a simple but widely used utility in thousands of projects, including Node and Babel. Its removal caused widespread issues, as many projects couldn’t retrieve this dependency, leading to build and deployment failures.
</li>
<li>
Resolution: NPM’s CTO, Laurie Voss, took the unusual step of restoring the “left-pad” module (version 0.0.3) to resolve the situation, prioritizing the community’s needs over the wishes of the individual author.
</li>
<li>
Aftermath: A new maintainer took over the “left-pad” module on NPM. Koçulu moved his projects to GitHub. NPM advised running <code>npm cache clear</code> for those still experiencing issues post-restoration.
</li>
<li>
Kik’s Response: Kik later clarified their stance, admitting that their communication could have been better and stating their original intent was to use the “Kik” name for their own open-source project on NPM.
</li>
</ul>
This event highlighted the fragile nature of dependency management in open-source projects and sparked a broader discussion about the rights of individual developers versus the needs of the community.

There is a nice <a href="https://youtu.be/IzqtWTMFv9Y?si=8DYOqqVXOJnkUjqf" target="_blank" rel="noopener nofollow">video</a> that covers both this case and the recent case with the <code>everything</code> package