The Day 11 Lines of Code Broke the Internet

In 2016, a developer removed a tiny package called left-pad from npm, the JavaScript package registry. Just 11 lines of code, all it did was pad a string with spaces. Within minutes, Facebook, Netflix, and thousands of other projects broke.

Why? Because they didn't depend on left-pad directly. They depended on packages that depended on packages that depended on left-pad. A chain of automatic dependency resolution, just like what apt install does behind the scenes.

Package managers are powerful. But that power rests on a chain of trust, and understanding that chain is part of thinking like an engineer.