--- title: Someone broke the Internet! Or why you may want to... description: Reflecting on the 2016 left-pad incident, where removal of an 11-line npm package broke builds worldwide due to a transitive dependency, the piece argues the... canonical: https://daily.dev/posts/someone-broke-the-internet-or-why-you-may-want-to-mirror-your-dependencies--wuxkqrfvy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Someone broke the Internet! Or why you may want to mirror your dependencies… | daily.dev og:description: Reflecting on the 2016 left-pad incident, where removal of an 11-line npm package broke builds worldwide due to a transitive dependency, the piece argues the... og:url: https://daily.dev/posts/someone-broke-the-internet-or-why-you-may-want-to-mirror-your-dependencies--wuxkqrfvy og:image: https://api.daily.dev/og/posts/WUXKqRFVY.png og:image:alt: Someone broke the Internet! Or why you may want to mirror your dependencies… og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Someone broke the Internet! Or why you may want to mirror your dependencies… **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 5 min read · 0 upvotes · 0 comments ## Summary Reflecting on the 2016 left-pad incident, where removal of an 11-line npm package broke builds worldwide due to a transitive dependency, the piece argues the real lesson is about dependency risk management rather than npm's fault alone. The author contends public package repositories should never allow deletes (citing NuGet's no-delete policy), argues it's unwise to depend on trivial utility code instead of writing it yourself, and recommends mirroring critical dependencies via private or hosted repositories (like MyGet) to avoid being at the mercy of upstream outages. Practical tips include checking local package caches, which often retain copies of removed packages. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened when the left-pad npm package was removed in 2016? The left-pad package, an 11-line string-padding utility, was unpublished from npm's registry by its maintainer, and because a widely used package depended on it transitively, the broken dependency chain caused JavaScript builds and installs to fail worldwide. The maintainer later explained the removal was tied to a dispute over another package name. _Developers tracking package registry incidents like this follow dependency risk stories on daily.dev._ ### Should I mirror my npm or NuGet dependencies to avoid an upstream outage breaking my build? Mirroring is worth it only if an upstream outage would be genuinely threatening to your operation; if you can tolerate a short delay or rewriting a trivial function, you don't need to. Private or hosted repositories such as MyGet let teams mirror packages, and NuGet also falls back to a local on-disk cache automatically when a source is unavailable. _Teams weighing dependency mirroring tradeoffs can keep up with package management practices on daily.dev._ ## Similar posts on daily.dev - [Why npm dependencies are a bigger security risk than your code](https://daily.dev/posts/why-npm-dependencies-are-a-bigger-security-risk-than-your-code-zyi7hulam) · LogRocket · 0 upvotes · 0 comments - [‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens](https://daily.dev/posts/no-way-to-prevent-this-says-only-package-manager-where-this-regularly-happens-zu1ifz0hb) · Hacker News · 0 upvotes · 0 comments - [Software dependencies are running away from us](https://daily.dev/posts/software-dependencies-are-running-away-from-us-8ly2du4kw) · InfoWorld · 0 upvotes · 0 comments - [Hackers abuse npm mirrors to host phishing redirect pages](https://daily.dev/posts/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages-qh9bqpbjo) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#npm](https://daily.dev/tags/npm), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/someone-broke-the-internet-or-why-you-may-want-to-mirror-your-dependencies--wuxkqrfvy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Someone broke the Internet! Or why you may want to mirror your dependencies…","url":"https://daily.dev/posts/someone-broke-the-internet-or-why-you-may-want-to-mirror-your-dependencies--wuxkqrfvy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/someone-broke-the-internet-or-why-you-may-want-to-mirror-your-dependencies--wuxkqrfvy"},"datePublished":"2026-10-04T13:04:20.223Z","dateModified":"2026-10-04T13:05:32.291Z","description":"Reflecting on the 2016 left-pad incident, where removal of an 11-line npm package broke builds worldwide due to a transitive dependency, the piece argues the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33cc190072d5da30ab0abcc64aef3a72?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33cc190072d5da30ab0abcc64aef3a72?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/someone-broke-the-internet-or-why-you-may-want-to-mirror-your-dependencies--wuxkqrfvy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,npm,nuget","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"Someone broke the Internet! Or why you may want to mirror your dependencies…"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/someone-broke-the-internet-or-why-you-may-want-to-mirror-your-dependencies--wuxkqrfvy#faq","mainEntity":[{"@type":"Question","name":"What happened when the left-pad npm package was removed in 2016?","acceptedAnswer":{"@type":"Answer","text":"The left-pad package, an 11-line string-padding utility, was unpublished from npm's registry by its maintainer, and because a widely used package depended on it transitively, the broken dependency chain caused JavaScript builds and installs to fail worldwide. The maintainer later explained the removal was tied to a dispute over another package name. Developers tracking package registry incidents like this follow dependency risk stories on daily.dev."}},{"@type":"Question","name":"Should I mirror my npm or NuGet dependencies to avoid an upstream outage breaking my build?","acceptedAnswer":{"@type":"Answer","text":"Mirroring is worth it only if an upstream outage would be genuinely threatening to your operation; if you can tolerate a short delay or rewriting a trivial function, you don't need to. Private or hosted repositories such as MyGet let teams mirror packages, and NuGet also falls back to a local on-disk cache automatically when a source is unavailable. Teams weighing dependency mirroring tradeoffs can keep up with package management practices on daily.dev."}}]} ```