average day in NPM land - programming.dev

440GB weekly for “is number”. What in the world is that package doing?

Anti Commercial-AI license

Deed - Attribution-NonCommercial-ShareAlike 4.0 International - Creative Commons

It handles a bunch of weird edge cases, mostly. And is downloaded almost 70M times a week!

I don’t get the concept that depending on 7 lines of code from a third-party package is remotely acceptable. It’s expanding the potential attack surface to save a dev from templating 7 lines of boilerplate. There’s no net benefit or appreciable time saved.

I’m glad I don’t have to deal with this regularly.

ETA: The package is even MIT licensed! There’s no excuse but laziness and not wanting to understand the code to import this rather than inlining or implementing a novel version. If I can spend the time to write:

if err != nil { slog.Warn("well shit", "error", err) return err }

after every function call…I just didn’t get it.

You’re right, it’s not sane! The js ecosystem is hell