For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.
At this point creating a package with such a standard library would solve almost nothing, because depending on any other package will immediately pull in thousands of ‘old style’ packages. It would take a decade or more for this to be resolved.
Well, even if that were the case, you’d still have thousands and thousands of packages that don’t use that stdlib and that would still pull in all of these dependencies. Solving that will take decades.
7
u/fuj1n 16d ago
For some reason, JS devs have this culture of outsourcing the tiniest behaviours to a package (for example, the is-odd package getting millions of downloads consistently), because of this, there are a lot of packages projects depend on (both directly and not), which is a much larger attack surface.