What happened
On 22 March 2016 a developer unpublished all of their packages from npm after
a naming dispute. One of them was left-pad, eleven lines that pad a string.
It sat deep in the dependency trees of very popular projects, so builds that
pulled fresh dependencies started failing all over the world. npm restored the
package within a few hours and later tightened its rules on unpublishing.
npm's own write-up: kik, left-pad, and npm.
How you'd spot it
# is this package anywhere in my tree, and through what?
npm ls left-pad
# does the registry still have it?
npm view left-pad versions
# install exactly what the lockfile says, nothing newer
npm ci
What I took from it
Most teams didn't know they depended on left-pad until it was gone. A build
that pulls straight from a public registry every time has a dependency on that
registry being up and that package still existing.
The fix most teams ended up with was a private mirror. Later, on platform work, I set builds up to pull through Artifactory, which caches every package it has served:
npm config set registry https://artifactory.example.com/api/npm/npm-remote/
If the upstream package disappears, the cached copy is still there.
What I do now
- Commit lockfiles and build with
npm ci(or the equivalent for your language). - Pull dependencies through a caching proxy you control.
- Know your transitive dependencies.
npm lsand an SBOM tell you what's really in the build.
stage 1 looks at what your builds depend on → see the engagements