Comment on The case for frameworksparentComments−waboremo3yNPM statistics are easily gamed https://dev.to/andyrichardsonn/how-i-exploited-npm-downloads...I don't doubt there are a lot of insignificant packages being used, again especially by beginners, I just don't buy it's to that scale−ramones133yIt's pretty easy to find that the example I gave isn't gamed... A cursory search on GitHub can find a couple examples like dotenv [1] and npm's cli [2] both use it via an older version of nodejs/readable-stream [3].There's also the classic left-pad debacle - https://github.com/left-pad/left-pad/issues/4[1] - https://github.com/motdotla/dotenv/blob/master/package-lock....[2] - https://github.com/npm/cli/blob/latest/package-lock.json[3] - https://github.com/nodejs/readable-stream/
Comments
NPM statistics are easily gamed https://dev.to/andyrichardsonn/how-i-exploited-npm-downloads...
I don't doubt there are a lot of insignificant packages being used, again especially by beginners, I just don't buy it's to that scale
It's pretty easy to find that the example I gave isn't gamed... A cursory search on GitHub can find a couple examples like dotenv [1] and npm's cli [2] both use it via an older version of nodejs/readable-stream [3].
There's also the classic left-pad debacle - https://github.com/left-pad/left-pad/issues/4
[1] - https://github.com/motdotla/dotenv/blob/master/package-lock....
[2] - https://github.com/npm/cli/blob/latest/package-lock.json
[3] - https://github.com/nodejs/readable-stream/