Next Gen Package Management
summary
Developers spend up to 50% of their time on toolchains while npm hosts roughly 2.5M packages after a recent 800k removal and the ecosystem records ~200 billion installs monthly; average projects show 683 transitive dependencies versus ~10 direct, and supply‑chain attacks rise ~742% year‑over‑year. Install results vary by manager (one test shows an ~850‑dependency difference), auth tokens often never expire, npm audit can balloon fixes (6 → 84), and a class of manifest confusion lets receipts differ from package contents. A new tool called volt (open source, npm‑compatible) aims to offer registry search, policies, dependency selectors and reproducible installs.
AI-written summary · about
chapters (11)
- 0:00Introduction and setup
- 3:01Current tooling issues
- 11:51Package manager's role
- 13:58npm features and flaws
- 17:49Installation process chaos
- 21:43Security vulnerabilities
- 26:57CI/CD and dependency bots
- 29:07Manifest confusion flaw
- 33:42Future state opportunities
- 37:02Dependency selector syntax
- 42:18Next-gen package manager
related talks
41mThe Future of JavaScript Package Management
41mnpm and the Future of JavaScript
39mWhat Can We Learn With JavaScript Fatigue?
44mYou Don't Know npm
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
42mThe Good, the Bad and NPX
37mNode.js Package Maintenance...
30mDependency management: the cause of—and solution to—all supply chain problems