NPM – "is-even", 160k weekly downloads

732K downloads per month.<p>722K of those downloads come from this package by the same authors: <a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;handlebars-helpers-ncc" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;handlebars-helpers-ncc</a><p>The handlebars-helpers-ncc package contains 130 different utility dependencies including a few actually useful things like functions to convert Markdown to HTML, but also some weirdly trivial packages like is-even.<p>I suppose this was a brilliant way for the authors to generate staggeringly high NPM download counts for their packages: Repackage other people’s useful code into convenience functions and then include their own trivial package dependencies several layers deep to multiply their overall downloads count.<p>I wonder how many jobs they’ve applied to while bragging about their millions of monthly NPM downloads.

Ha, I remember this package. It&#x27;s a dependency of a dependency of a dependency in several projects inside the company I work for. I think either React, Babel, or Webpack depended on it at some point in time.<p>Nobody needs to write satire about the state of Javascript package management when people write (and use!) libraries like these.

The entire package boils down to the following. I find it funny.<p><pre><code> &#x27;use strict&#x27;; var isOdd = require(&#x27;is-odd&#x27;); module.exports = function isEven(i) { return !isOdd(i); };</code></pre>

2̶7̶ 2 dependencies, travis ci configured, fully tested and documented, even the readme depends on some external tool. github username is i-voted-for-trump. Looks like a joke that people actually started using.<p>edit: Confused dependents with dependencies

Adding a package like this as a dependency is a net negative, because for the sake of trivial functionality you take on all the supply chain overhead and security risk.<p>The culture of relying on small dependencies needs to adapt to account for security. It&#x27;s one of many aspects of open source supply chain management due for a reckoning.

Ironic that this post makes it to front page but an admission that <i>any</i> npm package published before 2020 may have been hacked gets no interest! <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29234098" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29234098</a>

This is beautiful.<p>From the github user&#x27;s (&quot;i-voted-for-trump&quot;) bio:<p>&gt; This is a joke. You&#x27;ll only see this org if you are attempting to troll me about repositories I created when I was learning to program.<p>I give this troll effort a score of 9&#x2F;10. Well done - love the testing, readme, docs, continuous integration, etc. Honestly, this is better than most enterprise software I see.<p>I might contribute for fun and lulz...<p>EDIT - read some of the comments and there is some anger and confusion. Folks, this is a troll. Yes, npm and the JS ecosystem have some flaws, but let&#x27;s not get bent out of shape.

Why can&#x27;t NPM has something like Apache commons? There you can include all simple and fundamental functionality. Instead of having one package each like this.

<a href="https:&#x2F;&#x2F;github.com&#x2F;i-voted-for-trump&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;i-voted-for-trump&#x2F;</a><p>&gt; i-voted-for-trump<p>&gt; This is a joke. You&#x27;ll only see this org if you are attempting to troll me about repositories I created when I was learning to program.<p>&gt; is-odd<p>&gt; I created this in 2014, the year I learned how to program. All of the downloads are from an old version of <a href="https:&#x2F;&#x2F;github.com&#x2F;micromatch&#x2F;micromatch" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;micromatch&#x2F;micromatch</a>. I&#x27;ve done a few other things since: <a href="https:&#x2F;&#x2F;gith…" rel="nofollow">https:&#x2F;&#x2F;xn--gith-tc7a</a>

The developer&#x27;s most recent PR merged, with drama included <a href="https:&#x2F;&#x2F;github.com&#x2F;jonschlinkert&#x2F;cache-base&#x2F;pull&#x2F;23" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jonschlinkert&#x2F;cache-base&#x2F;pull&#x2F;23</a><p>I&#x27;m not sure what to think about this guy, but I think it&#x27;s more guilty those packages that decide to depend on these dependencies rabbit holes and is also fault of the platform for not showing how deep the dependency-chain goes.<p>We should focus more on improving how we choose dependencies

How does your company protect itself against supply chain attacks on NPM? At my company, we try to keep dependencies at a minimum, but I doubt this is effective as a protective measure.

This package is useful if you can&#x27;t even.

isEven is ridiculous but appears to be a joke so thats fine. isOdd being an actual dep is ridiculous and i dont think its a joke? edit: yeah is-odd seems to be a serious project. This is one of the first things people learn in a new language and we have a package for it? I guess its a teaching point? or maybe the author just wanted reputation..

Its dependency, is-odd, has 431,198 weekly downloads.

Sorry but I cannot take seriously any programmer who uses the package deliberately.

Why doesn&#x27;t the ECMAScript Committee tackle low-hanging bullshit like this?

These packages serve a very useful purpose in that they illustrate dependency abuse, but the fact isOdd DEPENDS ON isEven and isNumber is pretty funny.

Various boilerplate projects use &quot;is-even&quot; as a joke. It&#x27;s meant to be removed from your package.json when you start your project.

The code:<p><pre><code> &#x27;use strict&#x27;; var isOdd = require(&#x27;is-odd&#x27;); module.exports = function isEven(i) { return !isOdd(i); }; </code></pre> <a href="https:&#x2F;&#x2F;github.com&#x2F;i-voted-for-trump&#x2F;is-even&#x2F;blob&#x2F;master&#x2F;index.js" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;i-voted-for-trump&#x2F;is-even&#x2F;blob&#x2F;master&#x2F;ind...</a>

Thoughtful of the developer to add type defs.

Why is that even a package?<p>Hmmm... Why NPM? Why Node.js?<p>I am staying well clear of this in any important infrastructure.<p>I build test frame works out of Node.js (I had a set of bad choices) so I can get to know the thing. Made me hate it more.<p>All the mistakes ever made in computing rolled into one convenient system. Do not use this in important infrastructure. It is very bad.

There are two contributors to this package.

<a href="https:&#x2F;&#x2F;github.com&#x2F;jonschlinkert" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jonschlinkert</a><p>Interesting, 845 repositories by the user, and the vast majority of them are simple NPM modules such as this one.<p>Has there been any recent instances of someone abusing simple NPM repos like this for malicious intent?

Funniest thing about this is that is-even requires as a dependency another node package written by the same author, called &quot;is-odd.&quot; the is-even code just returns !is-odd. The &quot;is-odd&quot; package actually contains the logic for determining if a number is odd or even.

This issue of dependencies is exacerbated when a popular library has old and unmaintained dependencies 2-3 levels down that have security holes, and taking them out is a huge refactor.<p>I hope the JS community is moving away from this model, and I think a good example of that is DayJS.

<a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;is-ci" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;is-ci</a> tells you everything you need to know about where inflated download numbers comes from.

I see a missed opportunity for an &quot;is-odd-or-even&quot; package. &#x2F;s

See also:<p><i>I will pay you cash to delete your NPM module</i> <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29240952" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29240952</a>

So, who&#x27;s going to be the person to find all these dumb packages and replace them with PR&#x27;s to their dependents? Make PR&#x27;s to repos using is-even, is-odd, etc with n % 2 == 0; etc?

What&#x27;s odd is that &quot;is-odd&quot; has 430k weekly downloads.<p><a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;is-odd" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;is-odd</a>

During the week between 22nd and 28th Dec 2020, it shows a spike. Not an ordinary one, but more than 100x the regular figure! 19,960,098 downloads to be precise.<p>Edit: whoops, 100x

If I ever have an interview where I can use this, I’m 100% doing it and I hope that people appreciate it as the social commentary that it is.

Who wants to make an is-not-uneven package with me?

Anyone wants to take a bet that there are multiple packages called is-odd that depend on this one?

well, at least it gets an input and returns an output. what about this one <a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;noop2" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;noop2</a><p>it has almost 90k downloads a week

what happened between the 22 and 28 of December 2020? Almost 20 million downloads...

this may no seem like an odd comment (please at least admire the pun), but generally I can see value in this. All this stuff is-even and is-number is doing to make sure that it is actually a number, throwing errors etc. pp. sure, I could do it myself, but I would probably miss half of the cases and would spend some time finding the right solutions for the other half. Why I should reinvent the wheel if someone already has, and that in a good and thought through way? Don&#x27;t get me wrong, there are tons of needless packages on npm, but in this case I can see the value (ok, maybe the is-odd is one too much and !is-even would be enough)<p>just to to trigger a bit more: Pretty sure a case manufacturer could develop it&#x27;s own screws... but I think in most cases they just use what someone else provides...

somehow &quot;is-odd&quot; has even more <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29242598" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29242598</a>

Hilarious! It takes dependency on is-odd and just does a not (`!`).

And the current repo&#x27;s owner is &quot;i-voted-for-trump&quot;

The source requires is-odd... and then ! the call to it.

Which has a freaking DEPENDENCY on is-odd! Seriously?

this remind me of the standarjs dude, that add some nice ads on logs, just because he want it. standajs, is a yml config file. that is all

It even has one dependency, package is-odd

This package in turn depends on is-odd.

Why would you even use this?