diff --git a/_posts/2016-03-21-nplaym.md b/_posts/2016-03-21-nplaym.md new file mode 100644 index 0000000..30ebed8 --- /dev/null +++ b/_posts/2016-03-21-nplaym.md @@ -0,0 +1,45 @@ +--- +layout: post +title: Your node modules are Space Invaders +author: Jonathan King +categories: [opinion] +thumbnail: https://upload.wikimedia.org/wikipedia/commons/b/b9/Noodle_(2780523440).jpg +--- + +If you work with NodeJS, you'll know about NPM. It's simply a great package manager. Our Managing Director, [George Ornbo](https://twitter.com/shapeshed), even went as far as to say [it's the best he's ever used](/blog/whats-wrong-with-scalenpm-org/). However, when you work on large and complex applications, the number of packages you end up using can run away with you. Suddenly you're looking at a `package.json` that reads like a greedy child's Christmas wishlist. + +## Drowning in other people's code + +This problem is exacerbated by the fantastic but turbo-charged pace of change in the modern JS ecosystem. There are so many tools available now that, with the right skills and knowledge, you can take your ideas from zero to MVP at a breakneck pace. But what with all the transpilers, precompilers, prefixers, bundlers, boilerplate and hot reloaders that are becoming the _de facto_ standard these days (let alone the actual frameworks and libraries that help form the content of your code) I'm finding myself staring at a joyless install progress bar for longer and longer. + +**Perhaps the problem is NPM's speed and efficiency, perhaps it's the number of packages you are installing.** + +A few days ago I had a chat with my fellow pebble developer, the excellent [Mike James](https://twitter.com/export_mike). His popular [React Redux boilerplate repo](https://github.com/export-mike/react-redux-boilerplate), for instance, contains around 30 separate dependencies, with a similar number of different devDependencies. It's great when you've got it set up, but it's not quick to install, and it represents pretty much _the bare necessities of what is needed to work with those libraries_. + +Furthermore, not only is every dependency a bit of bloat that slows down installs, but [it's an attack surface](https://blog.liftsecurity.io/2015/01/27/a-malicious-module-on-npm). + +## Fire the lasers! Destroy the modules! + +I thought that it would be fun to make a game to demonstrate this issue, but that would also keep you entertained while your flurry of packages were installing. + +So I made `nplaym`: + +