Though I suppose it's not really Node's fault that developers are importing modules like "leftpad".
What's really fucking insane though is that there are modules like "trim-newlines" [0] that exist merely to trim \r and \n from the beginning and end of a string...and that this is such a hard task to get right that it's in version 4.0.2...and that a previous version had a security vulnerability [1].
As much as I hate to say it as I hate how these kinds of packages attach themselves to large projects to inflate download numbers for a resume I think most of us here would probably have created the same CVE doing it naively. It was a regex DoS due to exponential runtime not something obtuse like extra bloat being poorly made.
Sane? Absolutely not.
Though I suppose it's not really Node's fault that developers are importing modules like "leftpad".
What's really fucking insane though is that there are modules like "trim-newlines" [0] that exist merely to trim \r and \n from the beginning and end of a string...and that this is such a hard task to get right that it's in version 4.0.2...and that a previous version had a security vulnerability [1].
[0] https://www.npmjs.com/package/trim-newlines
[1] https://www.cve.org/CVERecord?id=CVE-2021-33623