Npm left-pad incident

Uncommon card · No. 153286

On March 22, 2016, programmer Azer Koçulu took down the left-pad package that he had published to npm (a package manager for JavaScript). Koçulu deleted all his packages after a dispute with Kik Messenger, in which the company was granted control of the package name kik by npm, Inc. As a result, thousands of software projects that used left-pad as a dependency, including the Babel transcompiler and the React web framework, were unable to be built or installed. This caused widespread disruption, as technology corporations small and large, including Facebook, PayPal, Netflix, and Spotify, used left-pad as a dependency in their software products. Two hours after the package was removed from npm, the company behind the platform, npm, Inc., manually restored the package. Later, npm disabled the ability to remove a package if more than 24 hours have elapsed since its publishing date and at least one other project depends on it. The incident drew media attention and reactions from people in the...

Read on Wikipedia