Left-pad incident explained: how 11 lines of JavaScript broke npm

On March 22, 2016, developer Azer Koçulu unpublished 273 packages from npm, including the 11-line left-pad function that Babel and Atom pulled in via transitive dependencies. Builds of thousands of projects failed for 2.5 hours until npm restored version 0.0.3 from backup. A week later npm introduced a 24-hour unpublish window.

• left-pad had 2,486,696 downloads in the month before removal
• Builds failed hundreds of times per minute for 2.5 hours
• The cause was line-numbers pinning exactly version 0.0.3
• npm added a 24-hour unpublish window, later widened to 72 hours