“This package, true to its name, depends on every other public npm package, creating millions of transitive dependencies.”
PatrickJS and friends published everything, and its 3,000+ sub-packages knock over any machine that installs it. npm’s post left-pad rule bars unpublishing any package another package uses, so one prank locked every author out of pulling their own code. The hoarders package pulled the same stunt with about 20,000 modules back in 2012. npm patched left-pad with a rule that any troll can turn into a weapon.