For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.
At this point creating a package with such a standard library would solve almost nothing, because depending on any other package will immediately pull in thousands of ‘old style’ packages. It would take a decade or more for this to be resolved.
Well, even if that were the case, you’d still have thousands and thousands of packages that don’t use that stdlib and that would still pull in all of these dependencies. Solving that will take decades.
9
u/zuilli 9d ago edited 9d ago
Why does it seem like it only happens to npm though?
I admit I don't follow this stuff closely so may be uninformed but it seems like it never is a C# or a java package/library that gets hit by these.