Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Readme: remove example with gulp imagemin #158

Open
andrew-aladev opened this issue Aug 19, 2021 · 2 comments
Open

Readme: remove example with gulp imagemin #158

andrew-aladev opened this issue Aug 19, 2021 · 2 comments

Comments

@andrew-aladev
Copy link

Hello, your example is not working anymore:

var imagemin = require('gulp-imagemin');

gulp-imagemin starting from 8.0.0 is ESM only, you can't use require.

Author of gulp-imagemin @sindresorhus doesn't look healthy: he tries to force ESM and nobody know why. It looks like youthful maximalism or some illness.

Please remove all usage of gulp-imagemin.

@twolfson
Copy link
Owner

That release looks only 7 days old. I'd prefer to wait and see how much resistance they gets from their approach. Would that be alright with you?

@andrew-aladev
Copy link
Author

andrew-aladev commented Aug 19, 2021

We can see here the following story:

  1. @sindresorhus writes 10-50 lines of code and creates a package
  2. he repeats this procedure 1500 times and creates about 1500 packages in npm.
  3. popularity is growing in next 5 years.
  4. he plants malicious code in every package.
  5. there is no mechanism in npm that may reset popularity immediately.
  6. developers will suffer until popularity will be dropped to zero.

We should report this situation as a bug in npm itself: it should handle a sensitive negative rating that affects search ranking and provide review section.

PS Current malicious code in 1500 packages is dangerous. Packages provides just small utilities and developer may use them in small scripts outside of main projects tests coverage. Developer will think that "this package is too small, it can't provide any harm for me", he will upgrade it to latest major version and nothing will happen. ERR_REQUIRE_ESM will appear in runtime only (for example in production).

PS See also sindresorhus/gulp-imagemin#356
PS See also yarnpkg/berry#3326

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants