Your weekly celebration of JavaScript and the web. This show records LIVE on Thursdays at 1pm US/Eastern time. Panelists include Jerod Santo, Feross Aboukhadijeh, Kevin Ball, Amelia Wattenberger, Nick Nisi, Divya Sasidharan, Mikeal Rogers, Chris Hiller, and Amal Hussein. Topics discussed include the web platform (Chrome, Safari, Edge, Firefox, Brave, etc), front-end frameworks (React, Ember, Angular, Vue, etc), Node.js, web animation, SVG, robotics, IoT, and much more. If JavaScript and/or the web touch your life, this show’s for you. Some people search for JSParty and can’t find the show, so now the string JSParty is in our description too.

The massive bug at the heart of npm

July 07, 2023 1:03:03 60.98 MB Downloads: 0

Darcy Clarke, former GitHub Staff Engineering Manager and founder of vlt, joins us to discuss a major bug in the npm ecosystem that he recently disclosed. We cover the bug’s timeline, nuances, and impact, all while setting some important context on npm packages, clients, and registries. Tune in to learn how to protect your codebase and gain a deeper understanding of this crucial part of the JavaScript ecosystem.

Leave us a comment

Changelog++ members save 2 minutes on this episode because they made the ads disappear. Join today!

Sponsors:

  • Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com
  • Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
  • Typesense – Lightning fast, globally distributed Search-as-a-Service that runs in memory. You iterlly can’t get any faster!
  • Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today.

Featuring:

Show Notes:

Something missing or broken? PRs welcome!

Timestamps:

(00:00) - It's party time, y'all
(00:40) - Welcoming Darcy
(02:56) - A massive bug
(05:04) - Ecosystem overview
(09:30) - But why?
(13:58) - Verdaccio
(16:46) - Why is this so broken
(27:38) - Timeline of the bug
(41:40) - Blog post feedback
(43:45) - Why, GitHub, why?!
(45:12) - Sponsor: Changelog News
(46:44) - How do we dig ourselves out
(53:14) - What the early days were like
(55:03) - What's next for Darcy
(57:25) - vlt (Volt)
(59:45) - Closing time!
(1:01:57) - Next up on the pod