You have probably heard it at a conference or read it in a thread: one JavaScript developer got angry, deleted 11 lines of code, and broke the internet. The code padded a string with spaces on the left. Everyone from build engineers to bloggers has retold it as a parable about fragile dependencies.
The parable is useful. It just gets the cause wrong, and the cause is the more interesting part.
The myth: one dev, one package, one tantrum
The popular version has a single package, left-pad, and a developer who yanked it in a fit of pique. The 11-line figure is the commonly cited size of the final version, and some headlines at the time said 17, so treat the exact count loosely. The package really was tiny. The tantrum framing is where the story drifts.
The crack: it was 273 packages, not one
npm’s own account says that on Tuesday, 22 March 2016, Azer Koçulu unpublished his package kik “and 272 other packages.” That makes 273, with left-pad one of them. Failures began shortly after 2:30 PM Pacific time. Developers saw the same message: “npm ERR! 404 ‘left-pad’ is not in the npm registry.”
So why kik? Kik is also the name of a messaging company. According to npm, the company wanted the package name, Koçulu and Kik could not agree, and npm applied its dispute policy. Its post says: “Entirely on this basis, we concluded that the package name ‘kik’ ought to be maintained by Kik, and informed both parties.” npm noted that Kik’s trademark “wasn’t pertinent” to that decision.
Koçulu’s reaction, as reported by The Register, was that npm is “someone’s private land where corporate is more powerful than the people.” In protest he removed all his packages. This was a protest about who gets to own a name, not a random act.
What the record shows about the outage
The damage was real, but narrower than “the internet.” What broke was installs and builds that depended on left-pad, directly or through other packages. The Register reported the package had been fetched 2,486,696 times in the previous month, so plenty of projects were exposed. npm says the disruption lasted 2.5 hours, while Quartz put it at about two. Sources differ on which big projects were hit, so treat any specific list with caution. npm itself names Babel and Atom as affected through a package that pinned an exact version.
The speed of the first fix also gets forgotten. Within about 10 minutes, another developer, Cameron Westland, published a replacement left-pad at version 1.0.0. It did not end the failures, because some dependency chains pinned version 0.0.3 exactly. A newer version does not satisfy a request for an old one.
What did end it was a decision npm called unprecedented. It announced at 4:05 PM that it would restore the original 0.0.3 from a backup, and finished at 4:55 PM. npm’s CTO Laurie Voss described it, per Quartz, as “un-un-publishing.”
Why the simple version won
The myth has everything a retelling needs: a villain or a hero depending on your side, a small and vivid object, and a good number. “A dev deleted 11 lines” fits in a tweet. “A name dispute escalated to a registry-wide protest” does not.
It also lets the reader off the hook. If it was one person’s whim, the fix is to not depend on that person. The record points elsewhere.
What the real version teaches
npm drew the conclusion itself: “Unrestricted un-publishing caused a lot of pain.” On 29 March 2016 it changed the rules. You can unpublish a version yourself only within 24 hours of publishing it. After that, support checks for packages that depend on it, and keeps the version if removal would break installs. A name that is fully removed gets a security placeholder.
The design flaw was not 11 lines. It was a registry in which a single author’s decision, in a dispute over a name, could remove code that many builds quietly assumed would always be there.
One sentence to retell it: left-pad was never a story about a tiny function, but about a naming dispute and a registry that let one account pull the floor out from under everyone. Which of your own dependencies could vanish tomorrow, and would your build notice before your customers do?
Related stories
Sources
- npm, “kik, left-pad, and npm” (March 2016)
- npm, “Changes to npm’s unpublish policy” (29 March 2016)
- The Register, report on the npm left-pad incident (23 March 2016)
- Quartz via Nextgov, “How one programmer broke the internet by deleting a tiny piece of code” (28 March 2016)
- “npm left-pad incident,” Wikipedia
- Featured image: contents of the left-pad 0.0.3 package (the actual code, cropped). E.Azer Koçulu, via Wikimedia Commons, MIT
SIGNAL TITANS
Leave a Reply