5 ms·

The owner of several 1 letter NPM packages

22 points by program 10y ago

mneil 10y ago
This account is clearly squatting. Not only do they hold several one letter package names but also many other names that are generic. The majority of them have nothing more than a package.json
- noobermin 10y ago
  A new version of website squatting? There can't be very much money in npm package squatting, though.
  - WaxProlix 10y ago
    A fellow poster up a bit mentioned that the empty 'D' package has something like 64k downloads per day. Surely there's money in compromising the systems that this ends up on? Malicious packages are a known point of vulnerability, and with that broad a shot, you're likely to get access to at least a few apps / AWS accounts / whatever.
- deleted 10y ago
  [deleted]
mod 10y ago
Sure, guy looks like a jerk, but these are terrible package names, I'm glad no libraries I use have these names. Google searches would be so bad.
- BinaryIdiot 10y ago
  Agreed, single letter library names are essentially useless. Some of the others, however, maybe not. Overall I'd like to see a policy against squatting on a specific library name and never using it.
  - franciscop 10y ago
    But there is one right in the footer: https://www.npmjs.com/policies/disputes https://www.npmjs.com/policies/disputes I am writing a blog post about the topic as well, I think NPM is doing a great job here.
    - BinaryIdiot 10y ago
      I had no idea. I never heard of npm doing this and missed it as a spot on the site. Thanks!
- um_ya 10y ago
  Only one I can think of that's useful is the q promise library. `npm install q`
BinaryIdiot 10y ago
Unlike domain names where people actually pay for them, I think package repositories like npm should punish squatting like GitHub. For example I contacted GitHub because I wanted an organization name for a company I'm registering in 2017. Their support looked at the organization, which had zero public or private repositories, told me they went beyond a time period of zero activity in which their name could be reclaimed by someone else and I got it (and no they didn't tell me the time period, it was just a vague statement regarding it). NPM should look at these and if they've been empty for X amount of time, remove them. Now the problem is controlling new squatters so they may need to offer a more complex solution when a name returns to the pool but I think it needs to be done (I know names don't typically return to be re-used in NPM but if they're removing them for squatting I think they should).
- subway 10y ago
  Even better, packages should be namespaced to the parties maintaining them
  - tlrobinson 10y ago
    That's just shuffling the problem around, people will squat on user accounts.
    - rwallace 10y ago
      Empirically, it doesn't just shuffle the problem around, it dramatically reduces it. On Google Code, every time you tried to create a project, the name would always be taken. On Github, every time you try to create a project, you can go ahead and use the name, and I haven't heard of anyone having trouble finding something acceptable to use for their account name.
  - chrisfosterelli 10y ago
    This has been supported for a long while now but it never really caught on much. It's still an option if your favourite name is taken, though.
lhnz 10y ago
https://www.npmjs.com/package/D https://www.npmjs.com/package/D Stats 64,840 downloads in the last day 1,360,036 downloads in the last week 4,980,362 downloads in the last month Why is this package so popular? Shouldn't NPM be able to determine the difference between packages that are in use and package squatting?
- elliottcarlson 10y ago
  Possibly missing a hyphen when issuing `npm install -D <something>`
- chrisfosterelli 10y ago
  It looks like npm is confusing the download count with another package, 'd' (lowercase)[0]. I didn't realize that npm packages were case-sensitive, and apparently neither does their download counter! Edit: Apparently there is a Github issue for this[1] [0]: https://www.npmjs.com/package/d https://www.npmjs.com/package/d [1]: https://github.com/npm/registry/issues/38 https://github.com/npm/registry/issues/38
  - franciscop 10y ago
    And I think they aren't anymore. But they were back in the day, so for compatibility reasons they have to keep some of them that way. Edit: further evidence: when you mistype a name in lowercase such as https://www.npmjs.com/package/aaaaaaaaaabbb https://www.npmjs.com/package/aaaaaaaaaabbb it gives you instructions on how to create the package with that name; however when you do with a name with a capital letter such as https://www.npmjs.com/package/aaaaaaaaaabbB https://www.npmjs.com/package/aaaaaaaaaabbB it just shows a 404
    - chrisfosterelli 10y ago
      Ah, that makes sense. Given that OSX and Windows are often case insensitive filesystems I could see that being a world of messy edge cases.
deleted 10y ago
[deleted]

22 points by program 10y ago

mneil 10y ago

This account is clearly squatting. Not only do they hold several one letter package names but also many other names that are generic. The majority of them have nothing more than a package.json

noobermin 10y ago
A new version of website squatting? There can't be very much money in npm package squatting, though.
- WaxProlix 10y ago
  A fellow poster up a bit mentioned that the empty 'D' package has something like 64k downloads per day. Surely there's money in compromising the systems that this ends up on? Malicious packages are a known point of vulnerability, and with that broad a shot, you're likely to get access to at least a few apps / AWS accounts / whatever.
deleted 10y ago
[deleted]

mod 10y ago

Sure, guy looks like a jerk, but these are terrible package names, I'm glad no libraries I use have these names. Google searches would be so bad.

BinaryIdiot 10y ago
Agreed, single letter library names are essentially useless. Some of the others, however, maybe not. Overall I'd like to see a policy against squatting on a specific library name and never using it.
- franciscop 10y ago
  But there is one right in the footer: https://www.npmjs.com/policies/disputes https://www.npmjs.com/policies/disputes I am writing a blog post about the topic as well, I think NPM is doing a great job here.
  - BinaryIdiot 10y ago
    I had no idea. I never heard of npm doing this and missed it as a spot on the site. Thanks!
um_ya 10y ago
Only one I can think of that's useful is the q promise library. `npm install q`

BinaryIdiot 10y ago

Unlike domain names where people actually pay for them, I think package repositories like npm should punish squatting like GitHub. For example I contacted GitHub because I wanted an organization name for a company I'm registering in 2017. Their support looked at the organization, which had zero public or private repositories, told me they went beyond a time period of zero activity in which their name could be reclaimed by someone else and I got it (and no they didn't tell me the time period, it was just a vague statement regarding it). NPM should look at these and if they've been empty for X amount of time, remove them. Now the problem is controlling new squatters so they may need to offer a more complex solution when a name returns to the pool but I think it needs to be done (I know names don't typically return to be re-used in NPM but if they're removing them for squatting I think they should).

subway 10y ago
Even better, packages should be namespaced to the parties maintaining them
- tlrobinson 10y ago
  That's just shuffling the problem around, people will squat on user accounts.
  - rwallace 10y ago
    Empirically, it doesn't just shuffle the problem around, it dramatically reduces it. On Google Code, every time you tried to create a project, the name would always be taken. On Github, every time you try to create a project, you can go ahead and use the name, and I haven't heard of anyone having trouble finding something acceptable to use for their account name.
- chrisfosterelli 10y ago
  This has been supported for a long while now but it never really caught on much. It's still an option if your favourite name is taken, though.

lhnz 10y ago

https://www.npmjs.com/package/D https://www.npmjs.com/package/D Stats 64,840 downloads in the last day 1,360,036 downloads in the last week 4,980,362 downloads in the last month Why is this package so popular? Shouldn't NPM be able to determine the difference between packages that are in use and package squatting?

elliottcarlson 10y ago
Possibly missing a hyphen when issuing `npm install -D <something>`
chrisfosterelli 10y ago
It looks like npm is confusing the download count with another package, 'd' (lowercase)[0]. I didn't realize that npm packages were case-sensitive, and apparently neither does their download counter! Edit: Apparently there is a Github issue for this[1] [0]: https://www.npmjs.com/package/d https://www.npmjs.com/package/d [1]: https://github.com/npm/registry/issues/38 https://github.com/npm/registry/issues/38
- franciscop 10y ago
  And I think they aren't anymore. But they were back in the day, so for compatibility reasons they have to keep some of them that way. Edit: further evidence: when you mistype a name in lowercase such as https://www.npmjs.com/package/aaaaaaaaaabbb https://www.npmjs.com/package/aaaaaaaaaabbb it gives you instructions on how to create the package with that name; however when you do with a name with a capital letter such as https://www.npmjs.com/package/aaaaaaaaaabbB https://www.npmjs.com/package/aaaaaaaaaabbB it just shows a 404
  - chrisfosterelli 10y ago
    Ah, that makes sense. Given that OSX and Windows are often case insensitive filesystems I could see that being a world of messy edge cases.

deleted 10y ago

[deleted]