The 11 Lines Of Code That Broke The Internet
In 2016, one developer unpublished a tiny package called left-pad, and builds broke across the JavaScript world.
The script
One developer deleted eleven lines of code... and thousands of projects stopped working.
The code was called left-pad. All it did was add spaces to the start of a piece of text.
But in twenty sixteen, after a fight over a name, its author pulled ALL his code.
Suddenly, builds everywhere started failing.
Because huge tools like Babel depended on it... through packages, that depended on packages, that depended on it.
npm restored it within hours, and changed its rules.
Now I ask Dropstone what a package pulls in before I install it. Because I still remember the day...
The facts, checked
- March 2016: after a dispute over the package name "kik", Azer Koçulu unpublished all ~250 of his npm packages.
- left-pad was about 11 lines; Babel and many React projects depended on it indirectly (e.g. via line-numbers).
- npm restored left-pad within hours and changed its unpublish policy.
