Chapter 14: Securing Your Code

In 2016, a dispute about the name Kik between the messenger service Kik (https://www.kik.com/) and open source contributor Azer Koçulu, who maintained a project with the same name, led to a complete outage of the internet. At least everybody noticed that day that something was wrong. What happened? Because of the dispute and npm siding with the messenger service, Azer retracted all his packages from the npm registry. Among the packages was a package called left-pad. Its purpose was to add characters to the beginning of a string of text. left-pad was a simple module with only 11 lines of code:

module.exports = leftpad;

function leftpad (str, len, ch) {

  str = String(str);

  var i = -1;

  if (!ch && ch !== 0) ch = ' ';

  len = len - str.length;

  while (++i < len) {

    str = ch + str;

  }

  return str;

}

...