AKakx·Sep 27, 2024
Well, npm did... https://github.com/npm/npm-registry-couchapp
In CouchDB 3.4.1 Releasednpm
npm-registry-couchapp
JavaScript2015–2024
npm / npm-registry-couchapp · Archived
npm-registry-couchapp
couchapp bits of registry.npmjs.org
5Distinct people
5Mentions
0Explicit recommenders
615GitHub stars
What to know before exploring
What it is
couchapp bits of registry.npmjs.org
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year5 dated mentions
Observed mentions: 2015-09-19 01:28:56 UTC to 2024-09-27 13:12:49 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
5 sourcesnpm does or did run on it https://github.com/npm/npm-registry-couchapp if that's what you mean by in-the-wild
In Cloudant/IBM back off from FoundationDB based CouchDB rewrite> The security of package managers is something we're going to have to fix.
why the generalization? lot of package manager have been serviceable for decades, their security model based solely on verifying the maintainer identity with clients deciding which maintainer to trust.
look at the amount of security advisories that are just 'malicious package' - https://www.npmjs.com/advisories
this is of course an issue with all package manager, but it's the lack of trusted namespacing that makes it easy to fall into it. (there's scope which sound similar but the protection model of the scope name is currently unclear to me and it's optional anyway)
compare to maven, where a package prefix gets registered along with a cryptographic key and only the key holder can upload to it to the central repo.
sure you get malicious packages going around, but
Read the rest
it's far easier not to fall into it because it's significantly harder to get user to download a random package off the namespaces he knows
> We're downloading heaps of untrusted code from the internet.
this is not something a package manager can fix, it's a culture problem. even including a gist or something off codepen is dangerous. a package manager cannot handle the 'downloading whatever' issue, it's not reasonable to put that in its thread model, because no package management maintainer can possibly guarantee that there is no malicious code in its repository and it's not its role anyway. a package manager is there to get a package to you as it was published at a specific point in time identified by its versioning, and its threat model should be people trying to publish packages under someone else name.
speaking of which it took npm 4 years to prevent people to publish a package with new code under an existing version number: https://github.com/npm/npm-registry-couchapp/issues/148 - they eventually came to sense but heck the whole node.js ecosystem gung-ho attitude is scary.
ied is great, and getting better.
Unfortunately, as detailed in a few npm3 threads, npm3 performance may forever be quite bad, due to a few ill-conceived features in npm's infancy.
Due to shrinkwraps and bundleDependencies, it's impossible for npm to know the full dependency tree until it has untarred every intermediate dependency [1]. In the future, it may be possible for a smarter server to cache this data and serve the full tree as part of the metadata, but that is a ways away.
There are some low-hanging fruit still in npm; for instance, the npm registry still doesn't gzip metadata for some unknown reason. Doing so could save as much as 80% on some larger metadata json, such as npm/npm itself [2].
1. https://github.com/npm/npm/issues/8826#issuecomment-15511591...
2. https://github.com/npm/npm-registry-couchapp/issues/224
In Show HN: Turn NPM installs into a Space Invaders style game in your terminalThe design doc for The npm Registry CouchApp
1 points · Open discussion