On 22 March 2016, a dispute over a package name led its author to unpublish 273 npm packages, including left-pad. According to npm's own account, thousands of projects broke and the disruption lasted about 2.5 hours. npm then changed its rules so that unpublishing a version that other packages depend on became harder.
What happened
npm's post says a dispute over the package name kik between developer Azer Koçulu and the messaging company Kik was decided under npm's dispute policy in Kik's favour. Koçulu then unpublished his kik package and 272 others, which included left-pad, a tiny function that pads a string. Many builds depended on it, directly or through other packages.
Within ten minutes, Cameron Westland published a functionally identical left-pad as version 1.0.0. That did not fix everything, because some dependency chains required version 0.0.3 specifically. npm worked with Westland to republish 0.0.3 from a backup, announced at 4:05 PM and completed by 4:55 PM. Community members republished other affected modules as forks or placeholders.
What npm said it would change
npm stated it stood by its dispute policy but accepted that unrestricted unpublishing caused a lot of pain, and that its communication had been poor and slow. It announced:
- making it harder to unpublish a version when doing so would break other packages;
- replacing fully unpublished packages that have known dependents with a placeholder, to block immediate adoption of the name;
- updating internal policies for handling community conflicts.
Why it still matters
The incident showed three things that remain true.
Small packages carry big weight. A function of a few lines sat under many projects, and nobody owned the risk.
Names are attack surface. If a name is freed, anyone can claim it. npm's placeholder rule exists because a freed name could be taken by someone malicious.
Availability is a security property. Nothing was hacked, yet builds stopped. Supply chain risk includes disappearance, not only compromise.
What to do in your own pipeline
- Use a lockfile and commit it. Pin exact versions so a build does not pick up a different package.
- Cache dependencies. An internal registry mirror or artifact cache lets builds continue when upstream changes.
- Reduce trivial dependencies. If a function is three lines, consider writing it, after weighing the maintenance cost.
- Track ownership. Know which dependencies have a single maintainer and no activity.
- Review new names. A package that appears under a familiar name after a removal deserves a look before use.
For the current rules on removing packages, see npm unpublish rules and malicious packages. Safeguard's dependency scanning can list every transitive package you rely on, and a free scan is available at gold.safeguard.sh/scan.
Quick check
Was left-pad hacked?
No. Per npm's account, its author unpublished it after a name dispute. The harm was availability.
How long did the disruption last?
About 2.5 hours, according to npm.
Sources
Last reviewed: 19 October 2026.
