The Future of JavaScript Package Management
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 14:40· Room 5HTERRAZA (Floor 5), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
JavaScript package management shows concrete failures and concrete fixes: the ecosystem counts 2.5 million packages and ~210 billion downloads per month but projects average 683 transitive dependencies, 75% of reported vulnerabilities live in transitive deps, and supply‑chain attacks grow ~742% year over year. Installing a 7‑dependency create‑react‑app yields a test range with over 850 difference in installed packages between managers. Problems listed include npm login tokens with no expiry, manifest vs tarball divergence (socket.dev detects this), and efforts like DSS, npm query and a new registry aim to make installs reproducible and auditable.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 2:08Current state
- 6:27Supply chain risks
- 9:16Package manager role
- 10:40Modern features benefits
- 13:27Interoperability challenges
- 14:10Search limitations
- 15:36Authentication issues
- 17:01Installation problems
- 19:07Inconsistencies across
- 21:14Non-determinism issues
- 21:35Lock file limitations
- 23:22Security tooling flaws
- 25:49Vulnerabilities and scale
- 27:11npm spam attack
- 27:53CI dependency backlogs
- 29:18npm publishing flaws
- 32:29Future tooling and Bun
- 33:33Standards and reproducibility
- 35:00Dependency Selector Syntax
- 37:29Key takeaways
- 38:17Q&A
related talks
41mThe Future of JavaScript Package Management
42mSecuring Your Software Supply Chain
41mnpm and the Future of JavaScript
26mHow npm is Making JavaScript Safe For Everyone
39mWhat Can We Learn With JavaScript Fatigue?
41mnpm and the Future of JavaScript
57mnpm and the Future of JavaScript
53mArchitecting Robust JavaScript Applications