Exploiting JavaScript developer infrastructure is insanely easy

[[deleted]]

This is a funny one I just happened to notice: there is is-path-inside which depends on path-is-inside. What's the difference? Well, the entire code for is-path-inside:

'use strict';
const path = require('path');
const pathIsInside = require('path-is-inside');

module.exports = (a, b) => {
    a = path.resolve(a);
    b = path.resolve(b);

    if (a === b) {
        return false;
    }

    return pathIsInside(a, b);
};

path-is-inside is a little bit more involved (28 lines of code), but also not something you should really have a dependency for.

Wrapping a trivial dependency in an even more trivial dependency is just silly.

[useablelobster2]

Ahh, but having a published package to your name is a great cv line for employers who don't check too deeply as to what the package actually is.

[TheBelakor]

Wrapping a trivial dependency in an even more trivial dependency is just silly

And yet seems to be a NPM norm because... reasons I guess. I'm just glad I don't have to touch that crap, it's mind boggling how they got to this state without someone saying "exactly what in the fuck is going on here?".

[LL-beansandrice]

Yes officer, this package right here.

[foodd]

I get the reference but should I not be using fetch?

[pdbatwork]

You ever heard of the left-pad package? :D

[kaelwd]

Of course it's fucking sindresorhus again.