{"id":112714,"date":"2024-01-05T15:10:15","date_gmt":"2024-01-05T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii"},"modified":"2024-01-05T15:10:15","modified_gmt":"2024-01-05T13:10:15","slug":"eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/eksperiment-s-sozdaniem-npm-paketa-zavisimogo-ot-vseh-paketov-v-repozitorii","title":{"rendered":"An experiment to create an NPM package dependent on all packages in the repository.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
One of the developers of JavaScript packages conducted an experiment by creating and publishing a package called «everything» in the NPM repository, which includes dependencies for all existing packages in the repository. To implement such a possibility, the «everything» package is directly dependent on five packages «@everything-registry\/chunk-N», which in turn are linked to over 3000 packages «sub-chunk-N», each of which is connected to 800 existing packages in the repository. <\/p>\n
The publication of «everything» in NPM led to two interesting effects. Firstly, the «everything» package became a kind of tool for carrying out DoS attacks since attempting to install it results in the downloading of millions of packages hosted in NPM, exhausting available disk space or stopping build processes. According to statistics, the NPM package has been downloaded about 250 times, but nothing prevents it from being added as a dependency to another package after the developer's account has been compromised to carry out sabotage. Additionally, some monitoring services and tools checking for new packages published in NPM were inadvertently under attack. <\/p>\n
Secondly, the publication of the «everything» package effectively blocked the possibility of removing any packages in NPM that ended up on its dependency list. A package in NPM can only be removed by the author if it is not being used as a dependency by other packages, but after the «everything» publication, all packages in the repository became encompassed by its dependencies. Notably, the removal of the «everything» package itself was also blocked, as nine years ago a test package called «everything-else» was published in the repository, which included the string «everything» in its dependency list. Thus, after publication, the «everything» package became a dependency of another package. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"