search

rschristian / voldephobia

A silly little tool to find out if your dependency tree is plagued with packages from You-Know-Who
https://voldephobia.rschristian.dev
MIT License
120 stars 2 forks source link

Support other users #5

Closed connorskees closed 2 months ago

connorskees commented 3 months ago

These two users have the same pattern of creating hundreds of tiny packages which depend on each other, and bundling them into popular packages.

https://github.com/doowb / https://www.npmjs.com/~doowb https://github.com/jonschlinkert / https://www.npmjs.com/~jonschlinkert

The latter of which is notable for is-even, which depends on is-odd, which depends on is-number.

rschristian commented 3 months ago

is-even is pretty clearly satire of the ecosystem, even if some people did start using it.

I don't inherently have an issue with small packages, or even interlinking them, but I do have an issue with one author in particular unilaterally forcing the ecosystem to adopt his packages and then using this as an appeal to authority. From a quick look, it doesn't appear as though either of those authors do the same?

connorskees commented 3 months ago

No, is-even wasn't satire. It was an actual package which the author really did use. Though, of course, it wasn't created sincerely. The author has the goal of padding his NPM download stats.

He mentions these stats quite frequently.

Captura de pantalla 2024-06-23 a la(s) 7 18 34 p m

Incredibly, these individuals work together by adding each other to packages and intentionally making use of the other's packages. For example, from a quick spot-check, the individual this repository is inspired by, and one of the individuals mentioned above have collaborated on a number of packages: https://www.npmjs.com/package/is-descriptor, https://www.npmjs.com/package/is-accessor-descriptor, https://www.npmjs.com/package/is-data-descriptor

Here are two examples of their packages: https://voldephobia.rschristian.dev/?q=assemble https://voldephobia.rschristian.dev/?q=handlebars-helpers

rschristian commented 3 months ago

No, is-even wasn't satire. It was an actual package which the author really did use. Though, of course, it wasn't created sincerely. The author has the goal of padding his NPM download stats.

He mentions these stats quite frequently.

Well that's disappointing.

Incredibly, these individuals work together by adding each other to packages and intentionally making use of the other's packages. For example, from a quick spot-check, the individual this repository is inspired by, and one of the individuals mentioned above have collaborated on a number of packages

It looks like these are packages that have been inherited going by the lack of any recent collaboration, the one public individual in the org, and that individual's donation sites plastered around on those repos? Problematic, I'll grant you, but it looks like there's no recent contributions to this madness from them?

Will think on it but this repo is pretty specific to one individual, given the name is a joke and commentary on how they/others tend to act.

ObserverOfTime commented 3 months ago

but I do have an issue with one author in particular unilaterally forcing the ecosystem to adopt his packages and then using this as an appeal to authority.

Personally, I forked this project (and adapted it for GitHub Pages) for a certain individual who tends to publish minimum effort packages with marketable names and often forces his own dubious license on them.

kravetsone commented 3 months ago

These two users have the same pattern of creating hundreds of tiny packages which depend on each other, and bundling them into popular packages.

https://github.com/doowb / https://www.npmjs.com/~doowb https://github.com/jonschlinkert / https://www.npmjs.com/~jonschlinkert

The latter of which is notable for is-even, which depends on is-odd, which depends on is-number.

+1 for https://www.npmjs.com/~sindresorhus

fa7ad commented 3 months ago

@kravetsone I disagree with that one. At least some of his packages are genuinely useful and as far as I know he's never tried to pull anything like what HE_WHO_MUST_NOT_BE_NAMED pulled. But feel free to 'spill the tea' in case I missed something 😅

jozefizso commented 3 months ago

Sindre makes great quality packages and he upgrades them continualy. I don't see why his packages should be marked. Yeah, he creates a lot of them but he does not throw them to each and every project out there.

rschristian commented 2 months ago

Going to close this on out as I have no intention of adding other users for the moment.

kravetsone commented 2 months ago

Sindre makes great quality packages and he upgrades them continualy. I don't see why his packages should be marked. Yeah, he creates a lot of them but he does not throw them to each and every project out there.

but a lot of looks like that: image