• expr@programming.dev
      link
      fedilink
      arrow-up
      6
      ·
      9 months ago

      It’s less of an issue of reviewing all packages than it is that this causes DOS in the first place. It’s pretty damn stupid that you can’t unpublish packages others depend on, and the whole recursive dependencies thing makes the situation a lot worse than it otherwise would be. Neither of these are issues with other package registries.

    • zygo_histo_morpheus@programming.dev
      link
      fedilink
      arrow-up
      4
      ·
      9 months ago

      One problem that’s particular to node is that you can’t unpublish packages if another package depends on them. As it says in the article, that means that no one can unpublish their packages, including the everyone package since someone apparently depends on that.