by Serguey Shinder
There was a small library we pulled in years ago to do one unglamorous job, some bit of parsing nobody wanted to write by hand. I did not review it. I did not read a line of it. I typed the install command, saw the download, and moved on, and my entire basis for trusting it was that a great many other people had apparently done the same. Popularity had stood in for scrutiny, and I had not even noticed the substitution.
The moment that changed me was reading, one ordinary morning, that a package much like it had been quietly compromised. Not attacked from outside, but poisoned from within, a new maintainer or a stolen account slipping something malicious into a version that then flowed automatically into thousands of builds that trusted it exactly the way I trusted mine. The people who were hit had done nothing wrong by the standards I had been using. They had done what I did. They had trusted the crowd.
That sent me looking at what our project actually depended on, and the tree went down and down. Our handful of direct dependencies each dragged in their own, and those theirs, until the real count was in the hundreds, most of them written by people I would never meet, running with the same privileges as the code I had labored over. I had been guarding my front door with real care while leaving a hundred side doors installed by strangers and never once counted.
What struck me was how invisible the trust had been. I never made a decision to trust those authors. There was no moment of choosing. The trust was the default, baked into the ease of the tooling, and ease has a way of feeling like safety when it is really just the absence of friction. I had confused nothing going wrong with nothing being wrong.
I did not respond by writing everything myself. That is neither possible nor wise. But I stopped treating a dependency as free. Now, adding one is a small decision with a cost, and I ask who maintains it, how it updates, what it could reach if it turned hostile, and whether the job it does is worth the door it opens.
The habit I have kept is simply to remember that every dependency is someone else's code running as if it were mine, with all the reach I have, on the strength of trust I mostly never chose to give. Popularity is not review. A million downloads is a million people who also did not read it. The crowd is not a security audit. It is just a very large number of us hoping the same thing.
– Serguey Asael Shinder
Leave a Reply