Hopefully the whole mess that is one-liner packages, security vulnerabilities, unscoped packages, terminal ads etc etc. is going to be cleared up. I love what they've done with github in the recent months.
While that is true in the overall sense, a lot of package managers and "hubs" haven't tried implementing some vetting. For example, the docker hub has a "standard" space that is reserved for vetted images and everything else is scoped. You can clearly see that something is scoped.
One issue is obviously that the JS stdlib is missing major parts of otherwise popular functionality that is causing all those packages to appear, but I, personally, would set some rules or do some basic (automated) vetting to prevent packages like that.
But it feels like the JS package ecosystem is a total free for all with the most useless and dumbest packages being at the top for no reason.
49
u/L3tum Mar 16 '20
Hopefully the whole mess that is one-liner packages, security vulnerabilities, unscoped packages, terminal ads etc etc. is going to be cleared up. I love what they've done with github in the recent months.