04/08/2025
In March 2016, developer Azer Koçulu removed a JavaScript package called “left-pad” from the NPM repository. The module had just 11 lines of code and added characters to the left of a string, like turning “7” into “007”.
Despite its simplicity, “left-pad” was a critical dependency in thousands of projects, including Babel, React, and Webpack. Its removal triggered widespread installation and deployment failures, affecting companies like Facebook, Netflix, and Spotify.
The incident disrupted parts of the web ecosystem for hours. NPM restored the package urgently, sparking debate over the fragility of open-source software and governance in public repositories.