11 lines broke npm
Did you know 11 lines of code broke JavaScript builds worldwide?
· 26-sec read
In March 2016, after npm gave the package name 'kik' to the messaging company Kik in a naming dispute, Azer Koçulu unpublished 273 of his packages. One was left-pad, an 11-line string-padding helper that Babel and Atom pulled in indirectly. Installs failed by the hundreds per minute for 2.5 hours until npm took the unprecedented step of restoring the original version from backup, then made unpublishing harder.
Why it matters
Every transitive dependency is part of your supply chain, so pin, mirror, and know what you pull in.
Sources
High confidenceChecked October 20, 2026.
- kik, left-pad, and npm (npm blog) blog.npmjs.org
- npm left-pad incident (Wikipedia) en.wikipedia.org