Post

Did my first talk regarding npm supply chain attacks at an internal developer conference last week. 🎉 My main talking point: Pay attention. It is so easy to mindlessly run an npm install without thinking about possible consequences. 🧵

Especially when you are a new developer you don’t even think about the possible pitfalls. This is why educating people is so important. I added @npmx.dev as an example because it does that in an unobtrusive way.

When looking at a package I am informed about vulns and deprecated packages and can start my own journey of looking into the specifics and seeing if it affects me. It helps me to pay attention!

Sadly it also goes beyond mere facts like these to flag opinionated stuff which hurts the creation of a sustainable and friendly atmosphere within OSS.

I know this feature and I really like it. Especially the case you presented. dotenv is an amazing project and it is still actively maintained. It still serves a purpose. But since node 20.6 it may not be necessary to depend on it anymore because there is a similar functionality built-in now.

This is specifically spoken from the perspective of a user of open source software and not from a maintainer perspective. But I can also see benefits for the maintainer of a package: reducing the number of users that are not the target audience frees up time and bandwidth for the important issues

And I think the banner also is very open about the source of the information. It directly links to the important parts and gives additional context. It allows you as a reader to take action directly at the source if you choose to do so. So I’m sorry but I fail to see the point your trying to make.

It says "The community has flagged this package as having more performant alternatives." and then links to the e18e community. The very least it could do is to at least flag that its the "e18e community" rather than the JS community at large. And change it to an info level box rather than warning.