On March 22, 2016, npm experienced widespread installation failures after the tiny JavaScript package left-pad was abruptly unpublished. Projects including Babel and Atom were affected through dependency chains—not necessarily because they depended on left-pad directly. npm reported that the disruption lasted 2.5 hours and later restored the missing version.
What happened in the left-pad incident?
The incident began with a dispute over the unscoped npm package name kik between its maintainer, Azer Koçulu, and the company Kik. npm says it applied its package-name dispute policy by deciding Kik should maintain that name. Its usual approach at the time was to leave existing package versions available to projects that depended on them.
As an Amazon Associate I earn from qualifying purchases.
Koçulu responded by unpublishing kik and 272 other packages, including left-pad. Shortly after 2:30 p.m. Pacific Time on Tuesday, March 22, npm observed hundreds of failures per minute as projects requested the now-missing dependency. npm described the impact as affecting many thousands of projects, not as a precise project count. npm’s March 23, 2016 postmortem said: “It was abrupt unpublishing, not our resolution policy, that led to yesterday’s disruptions.”
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why did left-pad break Babel and other projects?
The package was small, but its position in dependency chains gave it a much wider reach than its size suggested. A project can depend on a library that depends on another library, which in turn requests a small utility. If that utility disappears, installations can fail even when the top-level project never named it.
#1 Best Overall
Direct and transitive dependencies
A direct dependency is listed by a project itself. A transitive dependency is brought in by one of its dependencies. npm cited Babel and Atom as examples of projects whose chains included line-numbers, which explicitly requested left-pad version 0.0.3. The failure therefore spread through dependencies rather than requiring every affected project to use left-pad directly.
Why a new version did not fix existing requests
Cameron Westland published a functionally identical replacement as [email protected] within ten minutes. But line-numbers requested 0.0.3, and a request for that specific version is not satisfied by publishing a different version. The package’s code could be replaced quickly; the exact version expected by dependent projects was still absent.
Rank #2
How npm restored service
npm used a backup to restore the original [email protected]. It announced that plan at 4:05 p.m. Pacific Time and reported the restoration complete by 4:55 p.m. The postmortem gave the disruption’s total duration as 2.5 hours.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →npm also acknowledged its role in the platform’s vulnerability: “We dropped the ball in not protecting you from a disruption caused by unrestricted unpublishing.” The incident was not evidence that the entire registry went offline; npm described widespread failures when installations requested an unpublished dependency.
What left-pad did—and what to use instead
left-pad was a string-padding utility: it added characters to the beginning of a string until it reached a target width, such as filling with spaces or zeroes. Its archived, read-only repository labels the package deprecated and recommends the native JavaScript method String.prototype.padStart(). That repository guidance makes padStart() the appropriate starting point for new code rather than adopting the archived package.
What the incident teaches about dependencies
- Small packages can have outsized effects. A minimal utility can become part of many projects’ installation paths through transitive dependencies.
- Version requirements matter. A replacement published under a new version does not automatically satisfy consumers that request an older version.
- Removal and ownership are different issues. npm said its naming-policy decision would ordinarily leave existing versions available; the abrupt unpublishing removed the version requested by dependent projects.
- Registries are part of software reliability. Developers rely not only on package code but also on the continued availability of the versions their dependency chains request.
The policy details discussed in npm’s 2016 postmortem are historical, not a description of today’s rules. npm’s March 29, 2016 unpublish-policy announcement states that the policy was updated on January 30, 2020; it should not be treated as the current policy without consulting npm’s current documentation.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
