The Future of JavaScript Package Management
summary
JavaScript package management still centers on npm but shows concrete failures and partial fixes: the registry hosts 2.5 million packages and sees ~210 billion monthly downloads while typical projects pull in 683 transitive dependencies, creating attack surface that supply‑chain incidents grow by ~742% year‑over‑year. Different tools (npm, yarn, pnpm, bun, deno) produce wildly different installs — one test shows up to an 850‑package variance — auth tokens are over‑permissive, npm audit fix can increase vulnerabilities, and a new dependency query language (DSS / npm query via arborist) plus a fresh registry/manager are under development to fix reproducibility.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 2:08Current state
- 6:27Supply chain risks
- 9:16Package manager role
- 10:40Modern features benefits
- 13:27Interoperability challenges
- 14:10Search limitations
- 15:36Authentication issues
- 17:01Installation problems
- 19:07Inconsistencies across
- 21:14Non-determinism issues
- 21:35Lock file limitations
- 23:22Security tooling flaws
- 25:49Vulnerabilities and scale
- 27:11npm spam attack
- 27:53CI dependency backlogs
- 29:18npm publishing flaws
- 32:29Future tooling and Bun
- 33:33Standards and reproducibility
- 35:00Dependency Selector Syntax
- 37:29Key takeaways
- 38:17Q&A
related talks
41mThe Future of JavaScript Package Management
45mNext Gen Package Management
42mSecuring Your Software Supply Chain
26mHow npm is Making JavaScript Safe For Everyone
41mnpm and the Future of JavaScript
39mWhat Can We Learn With JavaScript Fatigue?
41mnpm and the Future of JavaScript
57mnpm and the Future of JavaScript