Developer Azer Koçulu unpublished all 273 of his npm packages — including left-pad, an 11-line string padding function — after a trademark dispute with Kik Messenger. left-pad was a transitive dependency of Babel, React, and Webpack. Builds failed globally for ~2.5 hours before npm took the unprecedented step of restoring the package from backup.
Sources: npm blog post
SOURCE_SINGLE_CONTRIBUTOR + PACKAGE_STALE_RELEASE pre-existing on trivial package
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Partial | SOURCE_SINGLE_CONTRIBUTOR + PACKAGE_STALE_RELEASE pre-existing on trivial package |
| Socket | Missed | Not detectable by package scanning |
| Snyk | Missed | No capability for this attack class |
| Sonatype (Nexus) | Missed | No capability for this attack class |
| Black Duck | Missed | No capability for this attack class |
| Endor Labs | Missed | No capability for this attack class |