NPM-EVERYTHING-2024

Summary

In late December 2023 (widely reported early January 2024), npm user PatrickJS (gdi2290) published a troll package named 'everything' that, via roughly 3000 chunked sub-packages, declared a dependency on every public package in the npm registry. Installing it triggered a denial of service through storage exhaustion and broken build pipelines. Because a package depended on by others cannot be unpublished, this registry-wide dependency web temporarily blocked many maintainers from removing their own packages until GitHub/npm intervened.

References

• https://www.bleepingcomputer.com/news/security/everything-blocks-devs-from-removing-their-own-npm-packages/
• https://socket.dev/blog/when-everything-becomes-too-much
• https://www.sonatype.com/blog/everything-matters-why-the-npm-package-sparked-controversy