npm left-pad incident - Wikipedia

Jump to content

Search

Search

Donate

Create account

Log in

Personal tools

Donate

Create account

Log in

npm left-pad incident

2 languages

Tiếng Việt<br>中文

Edit links

From Wikipedia, the free encyclopedia

2016 incident involving the npm platform

On March 22, 2016, programmer Azer Koçulu took down the left-pad package that he had published to npm (a package manager for JavaScript). Koçulu deleted all his packages after a dispute with Kik Messenger, in which the company was granted control of the package name kik by npm, Inc. As a result, thousands of software projects that used left-pad as a dependency, including the Babel transcompiler and the React web framework, were unable to be built or installed. This caused widespread disruption, as technology corporations small and large, including Facebook, PayPal, Netflix, and Spotify, used left-pad as a dependency in their software products.

Several hours after the package was removed from npm, the company behind the platform, npm, Inc., manually restored the package. Later, npm disabled the ability to remove a package if more than 24 hours have elapsed since its publishing date and at least one other project depends on it. The incident drew media attention and reactions from people in the software industry. The removal of left-pad has prompted discussion regarding the intentional self-sabotage of software as acts of protest and brought attention to the elevated possibility of supply chain attacks in modular programming.

Background<br>[edit]

left-pad was a free and open-source JavaScript package published by Azer Koçulu, an independent programmer based in Oakland, California.[1] The package repetitively prepends characters to a string using a loop.[1] left-pad has been characterized as being extremely simple,[2][3] consisting of only 11 lines of code in the final version authored by Koçulu, shown below:[4]<br>module.exports = leftpad;

function leftpad (str, len, ch) {<br>str = String(str);

var i = -1;

ch || (ch = ' ');<br>len = len - str.length;

while (++i len) {<br>str = ch + str;

return str;

Koçulu published left-pad on npm, the default package manager for Node.js, a JavaScript runtime environment.[5][2] Despite its relative obscurity, left-pad was heavily used; the package was used as a dependency by thousands of other software projects and was downloaded more than 15 million times before its removal.[6][7] Some of the projects that required left-pad were critical to the JavaScript ecosystem at the time. This included Babel, a transcompiler that enables backwards-compatible JavaScript code; Webpack, a module bundling system; and React and React Native, frameworks widely used to develop websites and mobile apps, respectively.[8][9][1]

In addition to left-pad, Koçulu also owned kik on npm, a tool that allowed developers to set up templates for their projects.[1] On March 11, 2016, Kik Interactive, a Canadian company that owned the instant messaging platform Kik Messenger, asked Koçulu to relinquish control of the kik package because the company owned the "Kik" trademark.[10] Part of the correspondence included the following message from Kik:

We don't mean to be a dick about [the kik package], but it's a registered Trademark in most countries around the world and if you actually release an open source project called kik, our trademark lawyers are going to be banging on your door and taking down your accounts and stuff like that — and we'd have no choice but to do all that because you have to enforce trademarks or you lose them. Can we not come to some sort of a compromise to get you to change the name without involving lawyers? Is there something we could do for you in compensation to get you to change the name?[3]

Koçulu responded shortly after, refusing to change the name of his project, saying:

"}},"i":0}}]}'/>hahah, you're actually being a dick. so, fuck you. don't e-mail me back.[3]

Koçulu also requested US$30,000 as compensation "for the hassle of giving up with my pet project for [sic] bunch of corporate dicks".[1]

On March 18, 2016, Isaac Z. Schlueter, the chief executive officer of npm, Inc., wrote to Kik Interactive and Koçulu, stating that the ownership of the kik package would be manually transferred to Kik Interactive.[1]

Removal<br>[edit]

After Koçulu expressed his disappointment with npm, Inc.'s decision and stated that he no longer wished to be part of the platform, Schlueter provided him with a command that would delete all 273 modules that he had registered.[10] Koçulu executed the command on March 22, 2016, removing every package he had previously released.[1] left-pad was one of the packages that was "unpublished", rendering it no longer publicly accessible on npm.[6] The left-pad software project and contents remained available on GitHub.[10]

Users attempting to build or install any JavaScript project that used left-pad as a dependency (including dependents such as Babel or Webpack) received a...