One of the JavaScript package developers conducted an experiment by creating and publishing a package called "everything" in the NPM repository, which encompasses all existing packages as dependencies. To implement this, the "everything" package is directly dependent on five packages "@everything-registry/chunk-N", which in turn are linked as dependencies to over 3000 packages "sub-chunk-N", each of which connects to 800 existing packages in the repository.
The placement of "everything" in NPM resulted in two interesting effects. Firstly, the "everything" package became a kind of tool for executing DoS attacks, as attempting to install it leads to downloading millions of packages hosted in NPM, exhausting available disk space or halting build processes. According to statistics, the NPM package was downloaded about 250 times, but nothing prevents it from being added as a dependency to another package after compromising the developer account for malicious purposes. Additionally, some services and tools responsible for monitoring and checking new packages uploaded to NPM were inadvertently targeted in this attack.
Secondly, the publication of the "everything" package effectively blocked the ability to delete any packages in NPM that were listed as its dependencies. A package in NPM can only be removed by its author if it is not being used as a dependency by other packages, but after the publication of "everything", all packages in the repository became caught in its dependency web. Interestingly, the removal of the "everything" package itself was also blocked, as a test package called "everything-else" was published in the repository nine years ago, which included the line "everything" in its list of dependencies. Thus, after publication, the "everything" package found itself as a dependency of another package.
Source: opennet.ru
