Many packages suddenly disappeared

[antoniobrandao]

https://www.npmjs.com/package/infinity-agent
https://www.npmjs.com/package/timed-out
https://www.npmjs.com/package/pinkie-promise

All dependencies of webpack-related modules

[JAertgeerts]

https://www.npmjs.com/package/require-from-string

[girishla]

massive issue for us because of this. Please resolve asap

[girishla]

I've tweeted npm support and also emailed them. Hope someone sees this soon

[allquantor]

npm/npm#19534

[jamesplease]

I believe this issue affects packages with versions before 2018 as well as versions after 2018.

Versions before 2018 cannot be installed, while versions after 2018 can be. For instance,

[email protected] is unavailable, while [email protected] is available. The difference between them is their publish year. Note that 2.0.2 was just published, which kicked off this series of problems.

---

Update: This theory appears to be wrong. See @BlackHole1 's comment below :)

Instead, this appears to be because floatdrop's packages have disappeared.

• Cached float drop account page
• Current float drop account page

[BlackHole1]

@jmeas Not so, because someone registered the package

[antoniobrandao]

They come and go.

Just today I've seen the package "infinity-agent" missing, then it came back, disappeared again, and came back again.

Very flimsy behaviour from NPM.

[jamesplease]

Ah, I see @BlackHole1 . That makes sense.

If that's the case, then this is a big security issue if someone hijacks a critical project and replaces it with some malicious code.

[teawithfruit]

@jmeas And I thought that this was only a "problem" between 1999 and 2000. ;)

[robbiethegeek]

@jmeas https://www.npmjs.com/package/require-from-string doesn't exist at the moment is that the page for your module?

[antoniobrandao]

I just HOPE during this time it is not possible to actually create a new package with the same name as these missing ones. So many projects would have their dependencies broken.

[girishla]

there should be a mirror for isssues like this

[mbensch]

@antoniobrandao It is possible. I have re-published some of the packages that were missing with the code that was available on git-hub. The original author has deleted his NPM account and dropped all his packages. But it seems like NPM keeps dropping packages. No idea why.

[antoniobrandao]

@mbensch OMG 😨😨😨😨

[lafama]

This one package https://www.npmjs.com/package/duplexer3 was unavailable for close to 30 mins. Now it back but interesting thing is that it appears its was published 5 mins ago

jekh published 19 minutes ago

[antoniobrandao]

So much for NPM reliability.

[paulwib]

Looks to me all these packages were originally published by @floatdrop, see google cache. Anyone seen any other users affected?

@mbensch looks like his account still exists just all packages gone.

[marco476]

Same problem for require-from-string package that don't allow me to use create-react-app.

[ghost]

@marco476 same here, can't even install create-react-app

[kiichi]

thanks, it's working now.

[Jakob-em]

Yeah up and running again

[devdigital]

pinkie-promise delivered here, pain now subsiding

[shacal]

Sysadmins replacing Intel machines with Raspberry PI's :D

[WojciechBanas]

You nearly caused nuclear war.

[uneco]

Good night you guys

[fathyb]

let me be the last oneeeeee

[WojciechBanas]

You nearly caused nuclear war.

[Repflez]

we ded jim

[julkue]

wooorks! whooop whooop.

[julkue]

wooorks! whooop whooop.

[retep998]

And this is why you should never use Javascript.

[julkue]

wooorks! whooop whooop.

[shacal]

Sysadmins replacing Intel machines with Raspberry PI's :D

[bnymncoskuner]

I have a nice story to tell my grandkids one day. It's been fun guys!

[anirudhmurali]

Get together is done. Get back to work y'all!

[Repflez]

morale of the story: cache everything?

[julkue]

wooorks! whooop whooop.

[tariqinaam]

backend dev somehow got part of this..

[lazarljubenovic]

GitHub so overloaded you can't even lock the issue? 😂

[Fabricio20]

Why aren't there copies of the npm repository like maven so there isn't a single point of failure?

[uneco]

what was I gonna do...?

[Adohk]

first

[shacal]

Sysadmins replacing Intel machines with Raspberry PI's :D

[artemkovalev92]

Party's over 🎉 Happy Saturday night coding

[danielweck]

pinkie 2.0.5 has just been published by some other dev! (not original https://www.npmjs.com/~floatdrop )
https://www.npmjs.com/package/pinkie
https://www.npmjs.com/~puradox
@floatdrop

[shacal]

Sysadmins replacing Intel machines with Raspberry PI's :D