<![CDATA[Is NPM the new DNS?]]>Is NPM the new DNS?

As in, "it's always NPM"

]]>https://board.circlewithadot.net/topic/ab25ddff-3fd2-4307-80b1-f3ec49900804/is-npm-the-new-dnsRSS for NodeFri, 15 May 2026 05:06:33 GMTWed, 13 May 2026 02:46:24 GMT60<![CDATA[Reply to Is NPM the new DNS? on Wed, 13 May 2026 06:41:18 GMT]]>@sawaba it couldn’t be NPM

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Tarah/statuses/116565899888290783https://board.circlewithadot.net/post/https://infosec.exchange/users/Tarah/statuses/116565899888290783Wed, 13 May 2026 06:41:18 GMT<![CDATA[Reply to Is NPM the new DNS? on Wed, 13 May 2026 02:58:42 GMT]]>@sawaba npm is the "we and our 347 trusted partners" of the development world

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116565024632120394https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116565024632120394Wed, 13 May 2026 02:58:42 GMT<![CDATA[Reply to Is NPM the new DNS? on Wed, 13 May 2026 02:57:07 GMT]]>@sawaba every time I review a customer's code and it's node I generate a report of every single transitive dependency they're pulling in and so far the median is hovering somewhere around 350. a few of them have been north of 1000. and that's before you count distinct versions used across different components, which usually inflates the number by another 50-200%. completely untenable behaviour for an ecosystem.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116565018392874361https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116565018392874361Wed, 13 May 2026 02:57:07 GMT