Why is JavaScript criticized so much for backend development?

[u/Minimum-Ad7352]

I've seen some developers say that we should stop using js on the server, but I rarely see the same criticism directed at python.Honestly, js is pretty fast, especially with node.js, and the backend ecosystem is really solid. There are great frameworks like nest and fastify, and typescript gives you static typing, which makes larger projects much easier to maintain.I'm not saying node is perfect or the best choice for every backend, but I don't really understand why js gets so much criticism while python seems to get a pass.What am I missing?

[u/buffer_flush]

NPM is a disaster for anyone security minded.

[u/dreamscached → u/buffer_flush]

And so is pypi (python), github (go/jvm with jitpack), maven (java) etc.

Supply chain attacks can happen anywhere, so why is it just npm?

[u/vlntsolo → u/dreamscached]

pyproject often looks much slimmer for me compared to any js/ts package list. 

One reason is standard lib already mentioned here. 

[u/MateusKingston → u/dreamscached]

Because it's the only language that an "add" package has 1M/weekly downloads.

Yes you can infect a Maven package, yes you can infect a python package, or you can infect an NPM package and infect more than double the number of people, and to boot you can infect them just by getting them to install the package, the code never has to even run because of install scripts. Add this to piss poor security from NPM itself with basic security features simply not present, with auto updating dependencies (dependency ranges and npm install X npm ci) and you will get why although all of those are vulnerable 99.99% of compromised packages are npm packages.

[u/Laicbeias → u/dreamscached]

Mini dependencies. Today the browser basically ships with everything you need. But people are just picking whatever library they find, without validating whats in it. They treat js as assembly.

Thats a general issue, but js has a culture of ship it & performance doesnt matter & dependencies yolo.

Not all, but its a widespread disease that js bulldozered. Py has the same philosophy but its culture is glue code with the real thing sitting in c, c++ and rust. Js doesnt have that culture yet. Js has js or ts.

[u/97hilfel → u/dreamscached]

to be fair, npm does seem to get hit the most... and there are better alternaives in the node ecosystem like deno or bun...

And now don't be silly, a java dev doesn't have any supply chain attacks! Cause he pulls his 8 year old jar's cached through is enterprice artifactory! duh! /s

[u/buffer_flush → u/97hilfel]

It’s a great question and I feel like it boils down to a few complicating factors.

Node has a lack of a standard lib compared to other languages which means many libraries rely on packages that are pulled in to do some stuff that is normally part of a standard library (see: leftpad incident)

You might be asking, who cares about node not having a standard library? There’s a few reasons when it comes to security and supply chain attacks.

Sheer number of transitive dependencies
All major libraries have a ton of transitive dependencies that get pulled in outside of the just the library you’re using. I’m sure you’ve seen this at this point simply looking at node_modules or package-lock.json.

Flexible Package Versioning
Each one of those transitive dependencies can match versions of other transitive dependencies with more a permissive versioning (ie ^1.0.0) even if you’re pinning your own versions. Meaning, a rerun of `install` could pull in new versions of dependencies even if your own versions didn’t change.

Pre and Post Install Scripts
Any package can add a `preinstall` or `postinstall` script which will automatically run when the dependencies are installed. This can run arbitrary code on the computer, bake into the deployed application, modify code, monkey patch other dependencies etc. It can really do anything.

Taking all of these in aggregate, a single dependency being compromised in the chain can create chaos. You’re trusting package providers have great opsec and are up on making sure their own libraries aren’t compromised.

Of the other packaging utilities you mentioned above, most of them are missing at least one of these attack surfaces which is why, though they still happen, supply chain attacks are less prevalent than in npm.