Post

Did my first talk regarding npm supply chain attacks at an internal developer conference last week. 🎉 My main talking point: Pay attention. It is so easy to mindlessly run an npm install without thinking about possible consequences. 🧵

Especially when you are a new developer you don’t even think about the possible pitfalls. This is why educating people is so important. I added @npmx.dev as an example because it does that in an unobtrusive way.

When looking at a package I am informed about vulns and deprecated packages and can start my own journey of looking into the specifics and seeing if it affects me. It helps me to pay attention!

Sadly it also goes beyond mere facts like these to flag opinionated stuff which hurts the creation of a sustainable and friendly atmosphere within OSS.

I know this feature and I really like it. Especially the case you presented. dotenv is an amazing project and it is still actively maintained. It still serves a purpose. But since node 20.6 it may not be necessary to depend on it anymore because there is a similar functionality built-in now.

The banner shows exactly that. It tells me that I MIGHT not need it. And with that it educates me. It shows me sth I might have missed. And it could help reduce my attack surface by relying on less third party dependencies.

This is specifically spoken from the perspective of a user of open source software and not from a maintainer perspective. But I can also see benefits for the maintainer of a package: reducing the number of users that are not the target audience frees up time and bandwidth for the important issues

It says "The community has flagged this package as having more performant alternatives." and then links to the e18e community. The very least it could do is to at least flag that its the "e18e community" rather than the JS community at large. And change it to an info level box rather than warning.

And even then its about as friendly as:

You missed a very important point. What happens in npmx‘s case is that you as the consumer are going to the npmx store, which has all the goods. And inside this store npmx decided to add customer notices to the products. You are free to go to another store without these customer notices.