npm install - Russian Roulette for Your Hard Drive

npm install is Russian roulette

You type npm install, grab water, come back to 1000 lines scrolling and 400MB of node_modules. You installed 3 packages? Here, have 944 friends.

2016 left-pad incident: ONE LINE of code. module.exports = function leftPad(str, len, ch) { return new Array(len - str.length + 1).join(ch || ' ') + str; } Millions of projects depended on it. Author deleted it. Babel, React, Webpack, Node.js - all broke. One line of code, entire JS ecosystem collapsed.

Lesson 1: one line can bring down the internet. Lesson 2: don't delete your packages.

package.json versions: ^4.0.0 = '4.x.x OK but not 5.x' (like an ex saying 'we can be friends but not get back together'); ~4.0.0 = '4.0.x only' (paranoid); 4.0.0 = locked (OCD); * = anything goes (crazy or startup).

pnpm saves: global store, hard links only. 100 projects use React? One copy, everyone references. Like shared bikes. npm install 3min -> 10sec, disk -70%.

Tips: commit lockfile to git, use pnpm, check download counts before installing, don't install lodash for one _.get.

npm made JS ecosystem a glorious marketplace but node_modules a black hole. That's frontend - chaos with order, randomness with crashes.