An 11-line JavaScript package was deleted and broke builds across the internet

On March 22, 2016, an independent programmer named Azer Koçulu unpublished all 273 of the packages he had published to npm, the default package manager for JavaScript and Node.js. Among them was a tiny package called left-pad — just 11 lines of code that pads the start of a string with characters. It was trivial, but it had been downloaded more than 15 million times, because thousands of other projects used it as a dependency.

The deletion was the climax of a petty but revealing dispute. Koçulu had published a package called 'kik'; the company behind the Kik Messenger app asked him to give up the name, and when he refused, npm itself transferred the package to the company. Frustrated, Koçulu asked npm's CEO how to delete all his packages — and was given the command to do it. He ran it, removing left-pad along with everything else.

The effect was immediate and outsized. Because so many popular tools depended on left-pad — directly or indirectly, including the Babel transpiler, the Webpack bundler and the React framework — builds and installs started failing across the JavaScript ecosystem, with 404 errors rippling through companies from Facebook and Netflix to PayPal and Spotify. npm restored the package within hours and later changed its rules so that widely-used packages couldn't be removed so easily. For a few hours, an 11-line function had broken a large part of the internet.