I’m following the odin project to learn web development. I had read about malicious packages in npm multiple times, so I avoided it until now. I’m on the webpack lesson now, and to use webpack, I need to install it using npm. I also see that it has many dependencies, and those dependencies will have other depenedencies and so on.

Why is it like this? Is there any other tool like webpack that doesn’t require npm? Or rather, can someone clarify how to properly use npm or link a guide that explains it? I have this kind of fear and reluctance about using npm after all the things I read.

  • arendjr@programming.dev
    5·
    4 days ago

    Finding a Webpack replacement that doesn’t use NPM at all is going to be hard, but there are certainly alternatives that don’t require the 1000+ NPM dependencies required to use Webpack.

    Some alternatives you can consider are Rsbuild and Farm. Part of the reason they use so much fewer NPM dependencies is because they’re written in Rust, so they’ll have Cargo dependencies instead, but you shouldn’t notice anything of that. Of course if you want to audit everything it’s not that much easier, but at least the Cargo ecosystem seems to have avoided quite some of the mistakes that NPM made. But yes, in the end it still comes down to the extent that you trust your dependencies.

    • danA
      5·
      4 days ago

      I really do enjoy that the web development community is finally getting excited about faster development tools, but…

      written in Rust

      It seems like there’s a new version of the old joke about vegans.

      Q: How do you know someone is a vegan writes code in Rust?
      A: They’ll tell you

      I don’t understand why the developers of these tools have to point out that they’re written in Rust in the first few sentences about the project, as if that’s the main feature? Programming language is an implementation detail, not a core feature. I don’t care what language my developer tools are written in as long as they’re fast.

      • arendjr@programming.dev
        5·
        4 days ago

        Hehe, yeah, I actually agree in principle, although in the context of web tooling I think it’s at least understandable. For many years, web tooling was almost exclusively written in JavaScript itself, which was hailed as a feature, since it allowed JS developers to easily jump in and help improve their own tooling. And it made the stack relatively simple: All you needed was Node.js and you were good to go.

        Something like the Google Closure Compiler, written in Java, was for many years better than comparable tooling written in JS, but remained in obscurity, partially because it was cumbersome to setup and people didn’t want to deal with Java.

        Then the JS ecosystem ran into a wall. JS projects were becoming bigger and bigger, and the performance overhead of their homegrown tooling started frustrating more and more. That just happened to be the time that Rust came around, and it happened to tick all the boxes:

        • It showed that it can solve the performance bottlenecks.
        • It has great support for WASM, which many web developers were having an interest in.
        • Its syntax is familiar enough for TypeScript developers.
        • It has a good story around interior mutability, which is a common frustration among TypeScript developers, especially those familiar with React.

        I think these things combined helped the language to quickly win the hearts and minds of many in the web community. So now we’re in a position where just name dropping “Rust” can be a way to quickly resonate with those developers, because they associate it with fast and reliable and portable. In principle you’re right, it should just be an implementation detail. But through circumstance it seems to have also become an expression of mindshare – ie. a marketing tool.