left-pad
A notorious 2016 npm package incident in which an 11-line package was depended upon by a large number of projects. When its author unpublished it, a cascading failure disrupted parts of the internet, making it a canonical example of excessive dependency in open-source ecosystems.
Core Facts
Timeline (last 90 days)
After the left-pad incident, npm was forced to restore the package and changed its unpublish policy to restrict the deletion of published versions after 24 hours.
Because left-pad was depended on by mainstream toolchains such as Babel, its disappearance caused a large number of builds worldwide to fail within a short time.
The left-pad incident was a famous accident in the npm ecosystem in March 2016: developer Azer Koçulu, due to a dispute with a company over a package name, removed the 273 packages he had published from npm, including left-pad, which was indirectly depended on by a large number of projects.
The left-pad incident was triggered when Kik demanded that npm forcibly transfer the package name "kik," and author Azer Koçulu, in protest, unpublished all approximately 273 of his packages from npm.
Because left-pad was indirectly referenced by toolchains such as React and Babel, its removal caused the entire front-end build ecosystem to temporarily grind to a halt.
padStart can directly replace the core functionality of left-pad, while padEnd handles right-side padding.
The left-pad incident prompted the community and standards committees to accelerate the incorporation of commonly used utility functions into the language core, reducing reliance on external packages.
Within hours of the left-pad incident, countless CI/CD pipelines worldwide experienced build failures, and npm subsequently made an exceptional decision to restore the package.
left-pad is a string left-padding utility with only a dozen or so lines of code.
The left-pad incident occurred in March 2016.
2 more timeline events
All Facts (16)
In the left-pad incident of 2016, an npm package of only 11 lines of code was withdrawn by its author, causing the build pipelines of mainstream projects such as React and Babel to be disrupted for several hours
80%UnverifiedAfter the left-pad incident, npm was forced to restore the package and changed its unpublish policy to restrict the deletion of published versions after 24 hours.
50%UnverifiedBecause left-pad was depended on by mainstream toolchains such as Babel, its disappearance caused a large number of builds worldwide to fail within a short time.
50%UnverifiedpadStart can directly replace the core functionality of left-pad, while padEnd handles right-side padding.
50%Unverifiedleft-pad is a string left-padding utility with only a dozen or so lines of code.
50%UnverifiedThe left-pad incident occurred in March 2016.
50%UnverifiedBecause left-pad was indirectly referenced by toolchains such as React and Babel, its removal caused the entire front-end build ecosystem to temporarily grind to a halt.
50%UnverifiedThe left-pad incident prompted the community and standards committees to accelerate the incorporation of commonly used utility functions into the language core, reducing reliance on external packages.
50%Unverified2016年npm上left-pad包被删除导致全球数千项目构建失败
50%UnverifiedThe left-pad incident was a famous accident in the npm ecosystem in March 2016: developer Azer Koçulu, due to a dispute with a company over a package name, removed the 273 packages he had published from npm, including left-pad, which was indirectly depended on by a large number of projects.
50%UnverifiedIn the left-pad incident of 2016, developer Azer Koçulu deleted over 270 npm packages due to a dispute over an npm package name, and the 11-line left-pad package caused build failures for a large number of Node.js projects worldwide.
60%UnverifiedIn the 2016 left-pad incident, an npm package of only 11 lines of code was unpublished by its author, causing the builds of mainstream projects such as React and Babel to break for several hours, and directly driving npm's registry immutability policy.
60%UnverifiedIn the left-pad incident of 2021, a single deleted npm package caused thousands of projects to fail to build
60%UnverifiedWithin hours of the left-pad incident, countless CI/CD pipelines worldwide experienced build failures, and npm subsequently made an exceptional decision to restore the package.
50%UnverifiedThe left-pad incident was triggered when Kik demanded that npm forcibly transfer the package name "kik," and author Azer Koçulu, in protest, unpublished all approximately 273 of his packages from npm.
50%UnverifiedDuring the left-pad incident experienced by the Node.js community in 2016, a package with only 11 lines of code was unpublished from npm by its author, causing thousands of projects to fail to build.
50%