Readit News logoReadit News
PragmaticPulp · 4 years ago
732K downloads per month.

722K of those downloads come from this package by the same authors: https://www.npmjs.com/package/handlebars-helpers-ncc

The handlebars-helpers-ncc package contains 130 different utility dependencies including a few actually useful things like functions to convert Markdown to HTML, but also some weirdly trivial packages like is-even.

I suppose this was a brilliant way for the authors to generate staggeringly high NPM download counts for their packages: Repackage other people’s useful code into convenience functions and then include their own trivial package dependencies several layers deep to multiply their overall downloads count.

I wonder how many jobs they’ve applied to while bragging about their millions of monthly NPM downloads.

ratww · 4 years ago
This is a very well known trick that we don't talk about much in public, but this is how most people with hundreds of repos on NPM get to this number.

One very popular terminal progress bar spinner has over 30 dependencies. One with the list of colors, another to display colors, another to clean the line, another to check if emojis are supported, another one with a list of emojis... plus a whole lot of wheel reinvention.

It was visible that most code in the sub-packages were just functions copied almost verbatim from StackOverflow.

It was also extremely limited when I tried to use it, and had quite a few bugs (it only really worked well on Macs at the time), despite the extremely large number of dependencies. Reimplementing took about 20 lines.

dexwiz · 4 years ago
This is what drives me insane about NPM. Libraries are useful, and even package splitting utils like underscore or babel make sense in some scenarios. But it only takes a few packages like these to explode the size of the dependency tree.
hulitu · 4 years ago
Wow, you just gave me a great idea for libc. Why not split it in libprintf, libscanf, libexit, libitoa, libstrbcpy etc. ? I'm sure the world will be better after this.
oefrha · 4 years ago
Ah, the infamous npm spammer jonschlinkert. This guy has even crazier packages like https://www.npmjs.com/package/ansi-red and I quote:

  Related projects
  ----------------
  ansi-reset
  ansi-bold
  ansi-dim
  ansi-italic
  ansi-underline
  ansi-inverse
  ansi-hidden
  ansi-strikethrough
  ansi-black
  ansi-red
  ansi-green
  ansi-yellow
  ansi-blue
  ansi-magenta
  ansi-cyan
  ansi-white
  ansi-gray
  ansi-grey
  ansi-bgblack
  ansi-bgred
  ansi-bggreen
  ansi-bgyellow
  ansi-bgblue
  ansi-bgmagenta
  ansi-bgcyan
  ansi-bgwhite
That fucking ansi-red "package" has 1.3M weekly downloads.

I have to actually check to make sure he doesn't have packages like regexp-left-parenthesis, regexp-dot, etc.

ratww · 4 years ago
The code of ansi-red for those interested:

    var wrap = require('ansi-wrap');
    
    module.exports = function red(message) {
      return wrap(31, 39, message);
    };
And ansi-wrap:

    module.exports = function(a, b, msg) {
      return '\u001b['+ a + 'm' + msg + '\u001b[' + b + 'm';
    };
Now imagine those things inside a real utility that gets adopted by some popular package.

jillesvangurp · 4 years ago
It's ridiculous and amusing at the same time. However, I blame the people depending on libraries such this; not the opportunists enabling them. They either don't know what they are doing (incompetence) or can't be bothered to do anything about it (indifference). The combination of can't be bothered and wouldn't know how to is what leads to people using shit like this.

In the defense of javascript, dead code elimination is kind of hard because it is such a dynamic/messy language and that kind of pushes people in the direction of ridiculously fine-grained modularization. Languages with an actual type system and compiler tend to produce artifacts that only include code that is actually needed. That requires dead code elimination that actually works. Beyond what comes with the browser, there isn't much of a standard library. That's for the same reason. You'd either end up shipping the whole thing on every website or depending on some convoluted tooling in an attempt to strip it down to what you are actually using. Minification is of course a thing but it usually boils down to more obfuscating than actually removing dead code.

My strategy is to generally avoid the whole ecosystem as much as I can. I've been using Kotlin-js lately. Great libraries, runs in a browser, reactive styled components using fritz-2, web compose, or if you really insist react. You still get exposed to some of the madness (like webpack breaking between minor releases) but mostly you are shielded from that.

zsims · 4 years ago
Spammer is a polite definition. His background is in marketing, the business he links brandscale[.]com is broken/abandoned. How long until we see these packages used as trojan horses? Or sold to third parties?
beaconstudios · 4 years ago
Let me balance the chi by linking to a prolific open source contributor who makes actually-good repos: https://github.com/sindresorhus?tab=repositories&q=&type=&la...
tyingq · 4 years ago
Oh, that's awful. It depends on ansi-wrap (another pretty much 1-liner package) with 2.6M weekly downloads.

Is there a site or code snippet where I can see which of the popular dependants was fooled into using this crap and is driving most of the downloads?

fspoettel · 4 years ago
It's very funny to me that these packages exist while one of his bigger projects (https://github.com/enquirer/enquirer) lists the following reason under "why use it":

> Lightweight - Only one dependency, the excellent ansi-colors by Brian Woodward.

Deleted Comment

athenot · 4 years ago
> Several years ago I switched careers from sales, marketing and consulting[1]

The author's bio on his GitHub profile explains it: he's approaching development with a mindset of sales and marketing. It's also followed by his GitHub stats front and center.

[1] https://github.com/jonschlinkert

phatfish · 4 years ago
I think we know how he created more than "1000 open source projects".

s/projects/functions

crimper · 4 years ago
ansi-red, making the world a better place!

Deleted Comment

HWR_14 · 4 years ago
> I wonder how many jobs they’ve applied to while bragging about their millions of monthly NPM downloads.

isEven claims to be a learning project. It depends on isOdd and isNumber, both of which were admitted (IIRC) to be explicit NPM download boosting projects. Such that the author of isOdd added it to major modules whenever they could

newsbinator · 4 years ago
isNumber would make for a legit package. Is there a good way in javascript to determine confidently if an arbitrary input is a number?

e.g: [1, "one", true, false, 0, "zero", null, undefined]

edit: also ["1", "0", etc]

edit 2: also [NaN]

cblconfederate · 4 years ago
that is odd
Aperocky · 4 years ago
The guy actually had a piece defending his practice making it to HN a few years back. It was not received well.
IshKebab · 4 years ago
Is that the same guy who was talking about how much work it is maintaining 200 repos?
midrus · 4 years ago
> I wonder how many jobs they’ve applied to while bragging about their millions of monthly NPM downloads.

I used to work for a company where it was ok (managers won't say anything, even if explicitly pointed at the situation) to remove company company code, create your own NPM package (on your own private NPM account) and add it as a dependency of the company codebase(s).

This and some other similar behaviours were the reason I left that company. But I'm the loser of the story here, as those guys are now working for even bigger companies with bigger salaries than me.

pizza234 · 4 years ago
> But I'm the loser of the story here, as those guys are now working for even bigger companies with bigger salaries

Another way to look at this is that a lower-paid SWE is paying for their mental health and morale. In my books, that's a winner :)

With the assumption that those engineers whose high/er salary in big/ger companies is not achived through mastery (Netflix is certainly not going to hire the Jon Schlinkerts), they're likely going to work with, say, "moral peers", which is typically undesirable for mentally healthy people.

itronitron · 4 years ago
They must be quite the 10X programmers to be able to contribute to open source like that while still holding a full-time job. (/s)
rizkeyz · 4 years ago
You must be kidding me. Color me old-fashioned, but software development for me is still a "serious" job - one that requires years of training, focus and patience to get through all the matter.

And you tell me these people don't give a single fuck?

vlunkr · 4 years ago
> I wonder how many jobs they’ve applied to while bragging about their millions of monthly NPM downloads.

Do people really do this? Does this explain the dumpster fire ecosystem of NPM?

ratww · 4 years ago
It is perfectly normal to see "N packages on NPM with N downloads" in resumés, and often a good sign.

...but interviewers often assume that they are all useful packages and that the numbers are not inflated.

swalls · 4 years ago
Which is something that can be fixed instantly: simply stop showing download counts on NPM.
op00to · 4 years ago
The author is a staunch anti-vaxer in addition to an open source huckster which seems to line up the fallacies of his “contributing to open source” with his willingness to spread lies about COVID and the vaccine.

Look at the guys Twitter: https://mobile.twitter.com/jonschlinkert

Deleted Comment

Aperocky · 4 years ago
Code smell is true lol.
nowherebeen · 4 years ago
> I wonder how many jobs they’ve applied to while bragging about their millions of monthly NPM downloads.

The sad thing about this is that people will buy it too

soheil · 4 years ago
What benefits do those authors accrue other just an increased download counter?
ratww · 4 years ago
Patreon and Github Sponsorships are popular ones. But also being able to add to their Resumé, being popular and leveraging it for other activities like talks and interviews, etc.
raverbashing · 4 years ago
I think you have the sell-side correct there.

And stretching the idea, people who download is-even for serious purposes are probably amongst the hopeless naive/inexperienced ones

Benjammer · 4 years ago
I think the horseshoe is almost coming back around to the point where people criticizing NFTs are bringing them up more often and in more annoyingly-out-of-context ways than the crypto people themselves...
game_the0ry · 4 years ago
That's awesome. I would hire them on just the creativity, and they also understand the js package ecosystem as well.
bryanrasmussen · 4 years ago
I mean the first guy who did it on the creativity, maybe the first 10, but nowadays that just means you can't think of anything else to boost your profile.
skeeter2020 · 4 years ago
>> and they also understand the js package ecosystem as well.

You mean how broken it is, and how to take advantage of it? Depending on your business they could fit in really well.

friedman23 · 4 years ago
That's one way to look at it, the other is that they will game whatever incentives you put in place at your company to your detriment.
mftb · 4 years ago
That's great hire them, then it will have served it's purpose. They can repackage all their trivial number related stuff up into one generally useful module, deprecate the old trivial ones and everybody can get back to work (with a smaller number of dependencies).
jeroenhd · 4 years ago
Ha, I remember this package. It's a dependency of a dependency of a dependency in several projects inside the company I work for. I think either React, Babel, or Webpack depended on it at some point in time.

Nobody needs to write satire about the state of Javascript package management when people write (and use!) libraries like these.

smt88 · 4 years ago
This package certainly seems like satire. It has no actual implementation in it. Instead it depends on another npm package: `is-odd`.

https://github.com/i-voted-for-trump/is-even/blob/master/pac...

ratww · 4 years ago
`is-odd` is made by the same developer. This was created to inflate NPM numbers.
cormacrelf · 4 years ago
The “Usage” section in the readme doesn’t even give you any information about how it behaves on inputs that aren’t numbers. I hope the is-odd package has some way of detecting whether the input is a number or not. Maybe other packages need this too!

    isEven(0);
    //=> true
    isEven('1');
    //=> false
    isEven(2);
    //=> true
    isEven('3');
    //=> false

madacol · 4 years ago
He probably moved that repo away from his profile (https://github.com/jonschlinkert) to avoid being trolled
pram · 4 years ago
Hilarious GH name, and apparently masterful troll.

Deleted Comment

moojd · 4 years ago
I wish some of these large projects would start seriously auditing their dependencies and stop pulling in dependencies that have many dependencies themselves. There is a one-two punch of a culture of "there's a package for that" and npm not requiring flat dependency trees by default. The denial in the node community that npm is uniquely bad is frustrating. I want the community to stop denying and own these issues so things can get better. It's going to take the authors of large packages to start evangelizing the use of fewer, higher quality packages, using flat dependency trees, and re-implementing trivial functions instead of adding another node to trust.
ratww · 4 years ago
It is an uphill battle, lemme tell you.

There is a bit of a culture clash inside Javascript. Even when you're a veteran contributor, sometimes maintainers resist changing packages, as simple as they are, because there is an implicit assumption that popular packages, or even packages with too many dependencies are "better" or "handled all the edge cases".

Even with careful evaluation of the options and a write-down of issues and a proper comparison, you need ten times as much energy to remove a package than it took to add it.

It's even worse is when "too many packages" is in the DNA of the package you're collaborating.

sulam · 4 years ago
The writing, okay, fine, dude was having some fun. Actually depending on it? Sigh.
sethammons · 4 years ago
The entire package boils down to the following. I find it funny.

    'use strict';

    var isOdd = require('is-odd');

    module.exports = function isEven(i) {
      return !isOdd(i);
    };

maxbaines · 4 years ago
Yes and is-odd contains

  const isNumber = require('is-number');

  module.exports = function isOdd(value) {
    const n = Math.abs(value);
    if (!isNumber(n)) {
      throw new TypeError('expected a number');
    }
    if (!Number.isInteger(n)) {
      throw new Error('expected an integer');
    }
    if (!Number.isSafeInteger(n)) {
      throw new Error('value exceeds maximum safe integer');
    }
    return (n % 2) === 1;
  };

maxbaines · 4 years ago
For good measure is-number contains

  'use strict';

  module.exports = function(num) {
    if (typeof num === 'number') {
      return num - num === 0;
    }
    if (typeof num === 'string' && num.trim() !== '') {
      return Number.isFinite ? Number.isFinite(+num) : 
        isFinite(+num);
    }
    return false;
  };

pibi · 4 years ago
I love the fact that this small code is still wrong:

  var isOdd = require("is-odd");

  console.log(isOdd([1])); // TRUE!!

eurekin · 4 years ago
Imagine, if isOdd suddenly changed to:

    'use strict';

    var isEven = require('is-even');

    module.exports = function isOdd(i) {
      return !isEven(i);
    };

f00zz · 4 years ago

    function isOdd(i) {
      return i > 0 && isEven(i - 1);
    }

    function isEven(i) {
      return i == 0 || isOdd(i - 1);
    }

mbesto · 4 years ago
And has 100% test code coverage. Brilliant.
Grieving · 4 years ago
2̶7̶ 2 dependencies, travis ci configured, fully tested and documented, even the readme depends on some external tool. github username is i-voted-for-trump. Looks like a joke that people actually started using.

edit: Confused dependents with dependencies

rnestler · 4 years ago
In the GitHub organization i-voted-for-trump it even states:

> This is a joke. You'll only see this org if you are attempting to troll me about repositories I created when I was learning to program

omnicognate · 4 years ago
27 dependents, i.e. things depending on it. Only one dependency: is-odd, hilariously.

I'd like to think it's a joke, but maybe not. Anyway, what's with the massive download spike, 20 million downloads between 22nd and 28th December 2020.

toomanybeersies · 4 years ago
It actually has 2 dependencies, `is-odd` depends on `is-number`
rezonant · 4 years ago
I assume they got it into a popular package around then, and it was promptly removed for being ridiculous.
dgrin91 · 4 years ago
In the about for the project it says

> I created this in 2014, when I was learning how to program.

uxp · 4 years ago
It would be one thing if it was _just_ a little demo utility used to showcase packaging and distribution of a trivial use case, however the creator of this has also created a number of packages which pull in these "demo" packages, like `handlebar-helpers`, which is again just these trivial function packages wrapped in handlebar decorators.

Several of these utility and helper packages are then pulled into other packages and build tools and marketed as legitimate packages, effectively hiding and masking the "just a demo" labels of the root is-even, is-odd, is-number packages. When people like myself complain about the absurdity of NPM supply chain verification, this is what we're arguing against.

pledg · 4 years ago
27 dependants, not dependencies. It has one dependency.
1_player · 4 years ago
I'm not sure where are you seeing that username, but no, sadly it's not a joke.
Grieving · 4 years ago
If you click on the github link, it redirects to an archived repo under that username.
rectang · 4 years ago
Adding a package like this as a dependency is a net negative, because for the sake of trivial functionality you take on all the supply chain overhead and security risk.

The culture of relying on small dependencies needs to adapt to account for security. It's one of many aspects of open source supply chain management due for a reckoning.

comeonseriously · 4 years ago
But DAMMIT, developer productivity, man!

But, honestly, do developers these days just not have their OWN libraries of code they bring along with them? Are they SO dependent on others they can't write trivial code?

toyg · 4 years ago
I reckon that centralized package management actually _reduced_ the amount of people relying on their own library of snippets. Why bother saving how you solved Problem A, when there is probably a package doing it better...?
globalise83 · 4 years ago
Ironic that this post makes it to front page but an admission that any npm package published before 2020 may have been hacked gets no interest! https://news.ycombinator.com/item?id=29234098
Nicksil · 4 years ago
>Ironic that this post makes it to front page but an admission that any npm package published before 2020 may have been hacked gets no interest! https://news.ycombinator.com/item?id=29234098

Not ironic. That article's unfortunate and misleading title isn't nearly as eye-catching as one describing the true nature of its content; a deliberate decision.

consumer451 · 4 years ago
Yeah, it really deserves a re-post or admin bump.. this is just crazy.

Does saying dang 3 times work?

game_the0ry · 4 years ago
This is beautiful.

From the github user's ("i-voted-for-trump") bio:

> This is a joke. You'll only see this org if you are attempting to troll me about repositories I created when I was learning to program.

I give this troll effort a score of 9/10. Well done - love the testing, readme, docs, continuous integration, etc. Honestly, this is better than most enterprise software I see.

I might contribute for fun and lulz...

EDIT - read some of the comments and there is some anger and confusion. Folks, this is a troll. Yes, npm and the JS ecosystem have some flaws, but let's not get bent out of shape.

pizza234 · 4 years ago
> From the github user's ("i-voted-for-trump") bio:

> EDIT - read some of the comments and there is some anger and confusion. Folks, this is a troll. Yes, npm and the JS ecosystem have some flaws, but let's not get bent out of shape.

It doesn't look like so. The author is definitely creating some confusion with redirects, but the readme of his professional Github's account (https://github.com/jonschlinkert) says:

> Several years ago I switched careers from sales, marketing and consulting to learn how to program, with the goal of making the world a better place through code. [...] To date, I've created more than 1,000 open source projects in an effort to reach my goal. Open source software takes a lot of time to create and maintain. You can help me to achieve my goals of changing the world through code, help me create better developer experiences, or just say thank you by sponsoring me on GitHub.

He's asking for real money; he's definitely not a troll.

gizdan · 4 years ago
> From the github user's ("i-voted-for-trump")

Well, his Twitter is on point.

Anyway, I'm pretty sure it wasn't a joke originally. I recall him heavily defending it even after people trolled him for creating such a package.

eunos · 4 years ago
Why can't NPM has something like Apache commons? There you can include all simple and fundamental functionality. Instead of having one package each like this.
thrower123 · 4 years ago
Why couldn't Javascript have ever built a halfway decent standard library?

Much of the terribleness of the current programming environment could have been rectified if this fundamental failure had not been allowed to continue.

chrisfinazzo · 4 years ago
We've been down this road before, and learned...nothing.

https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...

Stupid debates over a formatting tool - or in this case, a simple conditional - should tell you that something is seriously FUBAR in Javascriptland.

krapp · 4 years ago
Javascript has a perfectly decent standard library for its intended use case - scripting webpages. It was never meant to be a general purpose application or systems programming language. It was never meant to be used outside of the browser, much less to replace C++ and other languages in their respective domains.

The "current programming environment" is the problem, and it doesn't exist because Javascript is superior to other languages, and should be used everywhere, but only because web developers are easier to find and cheaper to hire.

And in any case, you could ship a "standard library" for javascript that covers most common use cases in a single static file. We used to do that, it was called JQuery. Even assuming for the sake of argument that Javascript's standard library is lacking, that doesn't justify the mess that is Node's micropackages.

Ginden · 4 years ago
> Why couldn't Javascript have ever built a halfway decent standard library?

Because it's consensus-driven, and that consensus is achieved on meetings organized every ~3 months.

And because of strict backwards compatibility rule, everyone is extremely cautious.

I tried to add new methods to Set, but proposal is basically being held hostage by subclassing proposal. https://github.com/tc39/proposal-set-methods

goohle · 4 years ago
Browser is the standard library for JavaScript language.
scns · 4 years ago
Deno provides one.
maple3142 · 4 years ago
I think lodash fits this role?