Section 4 of 5
What broke, and what it showed
Three incidents that were about the arrangement, not the code.
-
Eleven lines, and thousands of builds
In March 2016 an eleven-line package was unpublished and broke builds across the ecosystem. The code was trivial; the dependency graph was not.
Read → -
A maintainer handed a popular package to a stranger
The 2018 event-stream incident began with an ordinary handover of an unpaid maintenance burden, which is the part that has not been solved.
Read → -
An author broke his own libraries deliberately
In January 2022 the maintainer of colors.js and faker.js sabotaged both, which turned a labour question into an operational one overnight.
Read →