npm
This article is a stub. You can help the IndieWeb wiki by expanding it with relevant information.
npm is the Node package manager (although the npm project maintains it is not an acronym), though it can be used to manage javascript package for any type of javascript project (not limited to node.js or server-side js). It provides quick access to all of the packages available at https://www.npmjs.org
Criticism
Dependency hell
- 2020-12-16
Jeremy Keith npm ruin dev Ever had to revisit a project after, say, six or twelve months? Maybe you just want to make one little change to the CSS. But you can’t because a dependency is broken. So you try to update it. But it relies on a different version of Node.
Malware updates
- https://twitter.com/bantg/status/1504213698658938881
- "🚨 The authors of node-ipc have pushed malware in an update, which wipes your disk if you happen to have Russian or Belorussian IP address.
This affects some large projects like Vue CLI where it is a dependency.
https://github.com/RIAEvangelist/node-ipc/issues/233" @bantg March 16, 2022
- "🚨 The authors of node-ipc have pushed malware in an update, which wipes your disk if you happen to have Russian or Belorussian IP address.
Packages vulnerable to hijacking
- https://mobile.twitter.com/firefart/status/1532091679741825024
- "Want to watch the world burn? Here is a tool to check all NPM package maintainers for unregistered domains to hijack those packages by registering the domain again. NPM security guys are not interested in this data so here you go:
https://github.com/firefart/npmdomainchecker" @firefart June 1, 2022
- "Want to watch the world burn? Here is a tool to check all NPM package maintainers for unregistered domains to hijack those packages by registering the domain again. NPM security guys are not interested in this data so here you go:
See Also
- Node
- Humor: https://twitter.com/ikasliwal/status/1567640775659520000
- "The governor has declared a state of emergency and asked all Californians to not run `npm install` between 4 PM and 9 PM today in an effort to save energy." @ikasliwal September 7, 2022
- Criticism: frequently subject to supply chain attacks, so if you regularly auto-update your full dependency tree of packages, you're likely to get hit eventually with something like these: 2025-07-22: https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack and 2025-07-24: https://www.bleepingcomputer.com/news/security/hackers-breach-toptal-github-account-publish-malicious-npm-packages/
- moar malicious packages: Criticism: 2025-09-06 The Hacker News: Malicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys
- Why not: why you should not use auto-updated npm libraries at all for your personal website, and instead maintain strict static control/versioning for all your code and minimize use of any external libraries you have to update: 2026-05-21: Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack
…the attack propagated downstream to echarts-for-react with around 1.1 million weekly downloads. Socket reports roughly 639 malicious versions were published across data visualization, graphing, mapping, charting, and React component ecosystems.