Source code: Lib/profiling/sampling/ Tachyon logo The profiling.sampling module, named Tachyon, provides statistical profiling of Python programs through periodic stack sampling. Tachyon can run sc...

> On burn-out and bull-headedness

On June 4th, tea.xyz launched what it had been promising since 2022: a cryptocurrency that pays open source maintainers. Within the first hour of official trading, the token fell 75% from its opening price. A week later it trades about 90% below its first-day high, the company’s GitHub org has been near-silent for six months, and the founder’s public commits are going to a different project entirely. Their own blog post from June 8th, titled The Work Continues, concedes “the right response is not to pretend the launch went the way we wanted. It did not.” I’ve been pulling the public data: GitHub commit history, on-chain trading records, and the long paper trail tea left across the package registries. ## Where tea came from tea was founded by Max Howell, the creator of Homebrew, with Timothy Lewis. It came out of stealth in March 2022 with $8M led by Binance Labs, followed by an $8.9M seed round in December 2022. The pitch had two halves: a new package manager (the `tea` CLI), and a blockchain protocol that would reward the maintainers of open source packages with tokens. Howell wrote Homebrew and made nothing from it, and the pitch leaned on that history, famous Google interview rejection included. The two halves split in October 2023, when the package manager was renamed pkgx and moved to its own GitHub org (the old teaxyz/cli repo still redirects there) while the teaxyz org kept the crypto protocol. pkgx is a decent piece of software, and it never had a token in it. But the separation was only organisational: the company and founders stayed the same, and pkgx remained part of tea’s pitch as the eventual “cryptographically aware package register” for the protocol. ## The incentive design The white paper describes a mechanism called Proof of Contribution. Every package gets a score called teaRank, computed over the dependency graph and explicitly modelled on Google’s PageRank. The more packages depend on yours, the higher your rank, and rewards scale with rank. To claim a package you add a `tea.yaml` file to its repository containing your wallet address. The protocol paid out tokens in proportion to how many packages you controlled and how connected they were. Registering a thousand packages paid better than one, and declaring dependencies between them pushed their ranks higher still. Nothing in the design was costly to fake, since a package name costs nothing to register and a dependency is one line in a manifest. In February 2024 tea opened an incentivized testnet, a trial version of the protocol where points earned would convert to tokens at launch, and reported nearly 200,000 signups and 500 projects in the first week. ## The spam The farming started immediately, with pull requests on GitHub adding `tea.yaml` files to other people’s projects, trying to claim repos the submitter didn’t own. Howell called the PRs “disgusting and counter productive”. On the registries, Phylum documented new npm package publications climbing from mid-February 2024 to over seven times normal daily volume, with around 14,000 tea-registered packages across npm, PyPI, RubyGems, and crates.io. Sonatype counted roughly 15,000 on npm alone, with single accounts publishing hundreds of packages. RubyGems published an incident report describing empty gems created to farm rewards, including one six-year-old gem with over 100,000 downloads whose owner retroactively added a `tea.yaml` to cash in on it. In response they tightened publishing limits and blocked the accounts responsible. By August 2024, DEVCLASS reported research estimating that of roughly 890,000 packages published to npm in the prior six months, around 70% were tea farming spam. In November 2025, Endor Labs analysed the “IndonesianFoods” campaign: 43,000+ packages from at least 11 npm accounts over nearly two years, with auto-generated names from word lists. Amazon Inspector tied over 150,000 packages to the same token-farming campaign. Some coverage called it a worm, though Socket’s analysis found automation rather than self-propagation. The spam packages declared dependencies on each other to inflate teaRank, which meant installing any one of them pulled in the whole tree. An academic paper published in 2025 measures the abuse. The cleanup costs landed on npm, RubyGems, PyPI, and every mirror and security scanner downstream. tea responded that November by halting rewards distribution for the affected period and promising redesigned anti-spam rules. Howell told The Register the protocol would slash farmers’ rewards. ## The launch In September 2025, eight months before the protocol went live, tea ran a public sale on CoinList, a site that runs token sales for crypto projects: 4 billion TEA at $0.0005 each, implying a $50M valuation for the full 100 billion token supply. The terms unlocked 100% of the tokens on day one. Token sales usually stagger when buyers can sell, releasing tokens over months or years so early buyers can’t all exit at once. The launch plan, announced May 12th, put trading on Aerodrome, an exchange that runs as a program on Base, a blockchain built by Coinbase, rather than as a company matching orders. Prices on this kind of exchange come from a pool of paired tokens, TEA on one side and a dollar-pegged token on the other, and each trade moves the price along a curve. The smaller the pool, the more each trade moves it. tea seeded the pool with 2% of the token supply and scheduled the launch for 00:00 UTC on June 4th. $0 $0.0001 $0.0002 $0.0003 $0.0004 $0.0005 $0.0006 Jun 4 Jun 5 Jun 6 Jun 7 Jun 8 Jun 9 Jun 10 Jun 11 official launch, 00:00 UTC Jun 4 Hourly $TEA price on Aerodrome (TEA/USDC pool), data from GeckoTerminal The pool received its tokens from 22:47 UTC on June 3rd, and the first trade executed at 23:54 UTC, six minutes before the official launch. tea’s June 8th post describes this as “onchain liquidity activity occurred ahead of the coordinated plan”: the pool was live and tradeable before the launch sequence finished. In those six minutes the price was bid up to $0.00065, above the CoinList sale price. In the first official hour, from 00:00 to 01:00 UTC, the price fell from $0.00046 to $0.00011 on $332,000 of volume, down 75% in 60 minutes. The CoinList sale’s full unlock meant every September buyer was free to sell from the first minute, into a pool holding 2% of supply. The price has kept falling since and now sits around $0.00007, 86% below what CoinList buyers paid eight months ago, valuing the entire 100 billion token supply at roughly $7M against the $50M the sale implied. The collapse didn’t need anyone to withdraw the tokens backing the pool, and the pool still holds around $280K. Per the project’s own pre-launch transparency filing, about 20% of supply was circulating at launch, ten times what the pool held. ## The GitHub record Monthly commits across the teaxyz org and the pkgxdev org show how much of the company was still working by launch day: 0 100 200 300 400 Jan 2024 Jul 2024 Jan 2025 Jul 2025 Jan 2026 pkgxdev (package manager) teaxyz (protocol) Commits per month to non-fork repos in each GitHub org, via the GitHub API Commits to the protocol org ramped through late 2024 as the team built chai, their open package dataset, and the token contracts, and even the December 2024 peak was only 100 commits. Activity declined through 2025: chai’s main developer stopped committing in August, the dataset repo’s last commit was in September, and the token contract repo’s last sustained work was in October and November. After November 2025, the month tea halted rewards over the farming campaign, the org had 2 commits in December, 1 in January, 2 in February, and none since. The chart excludes forks, which hides the one place engineering continued: tea’s forks of go-ethereum and Optimism, the infrastructure for their blockchain, received steady commits from a single contributor through May 17th, 2026, two and a half weeks before launch. Howell wrote 236 commits to pkgxdev repos in January 2025 and kept a steady pace through May, then made only scattered commits until stopping entirely in November 2025. His public GitHub activity in June 2026 is in automic-vault, a new org created in April with no connection to tea or pkgx, while he remained tea’s CEO in press coverage as recently as December. pkgx itself is now mostly the work of one maintainer, Jacob Heider, who has carried the package-building pipeline more or less alone since mid-2025, lately assisted by Claude Code-generated pull requests that he reviews and merges. User-filed issues on the pkgx repo (then still teaxyz/cli) peaked at 78 a quarter in early 2023 and have arrived at a rate of 2 a quarter in 2026. In tea’s Discord, the conversation since launch is upset token holders: testnet participants who completed identity verification say they’re not eligible for the airdrop, the free distribution of tokens they spent two years earning points toward, and a week after launch the official line in the channel is that nobody has said there won’t be one. “The current price is a complete joke for everyone who participated in the project,” as one user put it, while the moderation bot issues warnings for bad word usage. The member list shows two people with the Core Contributor role, and neither is a founder. The channels for the open source side of the project, the dev and package dataset discussion, have had no real activity since 2025. tea’s post blames a bad week for crypto generally, and the wider market fell that week too. But the same post admits to “decisions, timing factors, and execution details that we are reviewing internally”, and the commit history shows few people left to conduct that review. Four years, roughly $17M in disclosed venture funding, and about $2M more from the public sale produced several hundred thousand spam packages and a cleanup bill paid by registries that never had any relationship with tea. The maintainers tea set out to pay, the ones with real packages and dependents, are left holding the same token as the farmers. _Data notes: commit counts are author-dated commits to non-fork repos in each GitHub org, collected via the GitHub API on June 11th 2026. Price data is GeckoTerminal hourlyOHLCV for the Aerodrome TEA/USDC pool on Base. Issue counts exclude pull requests, bots, and tea team accounts. The raw data and chart scripts are in data/tea on GitHub._

Astronauts aboard the International Space Station were ​ordered by NASA to shelter in their ‌spacecraft and prepare for potential evacuation on Friday as a Russian crew attempts to fix a worsening lea...

I have always wanted to own a Montblanc Writers Edition dedicated to Carlo Collodi, the Italian author whose real name was Carlo Lorenzini. He took his pen name from the Tuscan village where his mo…

Running `pip install requests` or `npm install react` against the public registry is the same operation, structurally, as running `apt install -t unstable` against Debian sid, and nobody involved talks about it that way. I don’t mean “unstable” as a synonym for buggy, I mean it in the specific sense Debian has used since the late nineties: a pool of packages where new versions land the moment a maintainer uploads them, with no promotion gate, no minimum residency time, and no quality bar between the upload and your machine. On a language registry any authenticated publisher can push any version at any time, the index updates within seconds, and any resolver that hasn’t been deliberately configured otherwise will start selecting it on the next run. The path from a maintainer pressing enter to an enterprise CI pipeline executing the result has nothing in it except whatever the consumer remembered to set up, and most consumers haven’t set up anything. Debian sid exists on the explicit understanding that you don’t point production at it. The default sources.list on a Debian install points at `stable`, where packages have spent months in `testing`, which they only entered after a mandatory stretch in `unstable` without release-critical bugs. Fedora has `updates-testing` with karma voting before promotion, Ubuntu has its `-proposed` pocket gated by autopkgtest, Arch has `core-testing` and `extra-testing` repos most users never enable, and FreeBSD ships both `quarterly` and `latest` branches of the ports tree. Every system package manager I can think of presents the user with a choice of stability lane and defaults to the conservative one, with the bleeding-edge lane as something you opt into knowing what you’re getting. Language package managers offer one lane, it behaves like the bleeding-edge one, and there’s no switch on the wall to ask for the other thing. We are well past the point where event-stream, Shai-Hulud, xz, and the current run of self-propagating GitHub Actions worms can be read as a string of unlucky one-offs. There is a malicious-package writeup from one security vendor or another most days of the week now, the GitHub Advisory Database adds `malware` entries faster than I can read them, and I’m tired of watching each one get treated as a clever attacker finding a surprising gap in an otherwise sound system. A registry that accepts uploads from tens of thousands of loosely verified publishers and serves the newest upload as the default resolution target within minutes is going to ship malware to consumers at some ambient rate, because that is what an unstable pool is for. We’ve wired that pool directly to production with no promotion step, and I find the recurring surprise harder to justify than the incidents themselves, given the design is the one distributions explicitly label as the lane you run at your own risk. ## The integration problem Distributions ended up with stability channels because a distribution owns the integration problem: tens of thousands of packages have to boot a working operating system together, so somebody upstream of the user has to check that glibc, systemd, Python, and GNOME all agree on the world before any of it ships. The release team is a structural necessity, and once you have a release team you have promotion gates, and once you have promotion gates you have channels almost by accident. Language registries made the opposite call early on by pushing the integration problem down to each consumer’s lockfile. There was never a single party whose job it was to ask whether `requests` 2.32.0 and `urllib3` 2.2.0 and `certifi` 2024.2.2 actually work together, so that question gets answered thousands of times a day in thousands of CI pipelines instead of once at the registry. With no upstream actor responsible for integration, there’s nobody in a natural position to run a promotion gate either, and the registries themselves have generally declined to be that actor, treating themselves as neutral pipes rather than as the governance layer a promotion policy would require. The vocabulary gap compounds this, because “channel” is a word from distribution and toolchain land (rustup has stable, beta, and nightly; conda has `defaults` and `conda-forge`; snap exposes tracks and flatpak exposes branches; Nix has `nixos-25.11` and `nixos-unstable`), while language registries talk about indexes, dist-tags, and pre-release markers, none of which carry the same connotation of “pick how much risk you want.” Someone who came up through Debian or Fedora packaging looks at npm and immediately sees the missing pattern, but someone who learned dependency management from `package.json` outward has no name for the thing that isn’t there, so it doesn’t register as an absence. A few language ecosystems have built partial equivalents, the strongest of which is Stackage, a curated set of LTS and nightly snapshots layered over Hackage and modelled on distribution release processes. It exists because Haskell’s type system makes cross-package incompatibility painful enough that curation moved upstream rather than staying in everyone’s `cabal.project`. It has been the default resolver target for `stack` for over a decade now, which makes it an existence proof that a language community can run a curated lane on top of an open registry without forking the registry. Conda treats channels as first-class and lets you compose `defaults`, `conda-forge`, and domain-specific channels in something close to an `apt sources.list`, though that’s as much about subject-area curation as stability tiering. rustup’s stable/beta/nightly applies to the compiler rather than to crates, and npm’s dist-tags (`latest`, `next`, `beta`, `canary`) are publisher-controlled, voluntary, and per-package rather than registry-wide. PyPI relies on PEP 440 pre-release markers that pip skips unless you pass `--pre`, TestPyPI is a publishing rehearsal space rather than a staging lane, and the rest (RubyGems, Maven Central, NuGet, Hex, Go, CPAN) have nothing at the registry level at all. ## The urgency objection The main objection to any delay between publish and install is that security fixes can’t wait: a maintainer ships a CVE patch, consumers need it in production today rather than after seven days in a holding pen, and a cooldown that blocks the fix leaves everyone exposed for a week longer than necessary. Attackers know this and exploit the same reflex, which is why the `npnjs.com` phishing campaign against maintainers arrived as forged npm support email, why the xz backdoor was hustled toward distribution releases, and why “update immediately” in an incident thread is indistinguishable on the wire from the next attack’s delivery mechanism. An index with no promotion gate can’t tell a genuine emergency patch from a forged one because it applies the same zero scrutiny to both. Distributions have had a separate security pocket for this for as long as they’ve had stable releases. Debian’s security archive and Fedora’s stable updates repo bypass the normal testing migration so a fix can reach users in hours, but the upload still passes through a security team rather than landing the moment whoever holds the credential presses publish. That team can also ship a patched build without waiting for upstream at all, which language ecosystems mostly can’t: for npm or PyPI the only delivery path for a fix is the upstream maintainer publishing a new version to the one ungated index, which is a large part of why the urgency feels so non-negotiable in the first place. ## Cooldowns, proxies, and promotion pipelines You can watch the ecosystem reconstructing Debian’s promotion model piece by piece without using any of its vocabulary in the cooldown wave of the last year, where pnpm, Yarn, Bun, npm, uv, and pip all shipped some variant of “don’t select versions newer than N days” within months of each other. Each of those is a per-consumer reimplementation of Debian’s minimum-time-in-unstable rule, configured at the edge in every project that remembers to turn it on. The gem.coop cooldown endpoint is the closest anyone has got to an actual second channel rather than a client-side approximation of one. It’s a separate source URL serving the RubyGems catalogue with newly published versions held back for 48 hours, so a project opts in by changing one line of its Gemfile rather than by upgrading Bundler or learning a new flag, and every Bundler version ever shipped already understands it because from the client’s side it’s just a gem source. That is structurally the `sources.list` model, where the stability policy lives in which index you point at rather than in client configuration, and the work of deciding what’s settled enough to serve happens once upstream instead of being reimplemented in every consumer’s config. At the heavier end, every Artifactory or Nexus deployment with a dev → staging → prod promotion pipeline is rebuilding the Debian pocket model inside a single company, complete with policy gates that block artifacts until they’ve passed scanning and sat for a quarantine period. Tools like devpi on the Python side, Athens for Go, assorted verdaccio configs for npm, and lighter-weight caching proxies absorb the same demand privately, which is part of why the pressure for a registry-level feature stays diffuse: every organisation large enough to need a stable lane builds one internally, and the result never becomes a shared demand on the upstream registry. I’m not calling for a new standard or a clever resolver hack, because the design work was done a quarter of a century ago by people who are still running it in production. Debian’s testing migration rules, Fedora’s Bodhi karma system, and FreeBSD’s quarterly branches are documented, battle-tested promotion functions sitting in public repositories, and the language-packaging side keeps reinventing individual fragments of them, calling each fragment something new, and shipping it as a novel supply-chain feature. The cooldown flags are the smallest possible channel, a single time-based promotion criterion applied at the edge, and six tools converging on the same feature in the same year is six independent rediscoveries of one line of `britney`’s config. What a registry-level stable lane would look like for PyPI or npm, and who would run the promotion function, is something I want to come back to separately, starting from the distro release-team docs rather than a blank whiteboard. The reframe I’m after in the meantime is just an honest label on what we already have. If npm or PyPI offered two indexes tomorrow and described one of them the way Debian describes sid, as a development staging area that changes by the minute and is pointed at by people who accept they’ll be the first to hit whatever breaks, I don’t think many teams would deliberately aim a production build at it. Every production build is aimed at exactly that today, not because anyone weighed it against an alternative but because no alternative has ever been on the menu, and a fair amount of “supply-chain security” work is the industry slowly noticing it never got asked.

Yesterday the axios package was compromised on npm. An attacker hijacked a maintainer account, published two malicious versions that bundled a remote access trojan through a staged dependency called `plain-crypto-js`, and the versions were live for two to three hours before npm pulled them. Axios gets 83 million weekly downloads. This keeps happening over and over and over and the post-incident conversation always goes the same way: was the maintainer using MFA, should the registry have caught it faster, should people be running more scanners. None of that gets at why JavaScript keeps having these incidents at a rate no other ecosystem comes close to matching. The npm client’s defaults actively enable the attacks and have done for years. ### npm install rewrites your lockfile `npm install` will modify your lockfile if it detects drift between `package.json` and `package-lock.json`, which means the command developers reach for by default, the one in every tutorial and onboarding doc, can silently change your resolved dependency tree. The behaviour you actually want in almost every case lives in `npm ci`, which refuses to install if the lockfile doesn’t match and never modifies it. Most developers only discover `npm ci` after something breaks in CI, and many never discover it at all, because the client steers them toward the less safe option by making it the obvious one. ### Lifecycle scripts run by default When you run `npm install`, every dependency and transitive dependency gets to execute arbitrary code on your machine through postinstall scripts. A vanishingly small number of packages actually need this, mostly native addons that compile C/C++ bindings, but npm grants the privilege to everything by default. The axios attacker used exactly this mechanism, staging a clean version of `plain-crypto-js` eighteen hours before publishing a second version with the payload, then adding it as a dependency to the compromised axios release so the RAT dropped automatically on install. pnpm v10 disabled postinstall scripts by default and moved to an explicit allow-list where you approve which packages can run scripts. Bun blocks them by default too, with opt-in via `trustedDependencies` in `package.json`. npm shipped `npm trust` in v11.10.0 for managing an allow-list, but left the default unchanged, so every package still gets to run whatever it wants unless you’ve gone out of your way to configure it otherwise. ### Trusted publishing can be turned off npm’s trusted publishing via OIDC lets packages publish from CI without long-lived tokens, which is a genuine improvement. But a maintainer, or an attacker who has compromised their account, can disable trusted publishing and fall back to token-based publishing at any time, and consumers of the package have no signal that this happened. They’ll keep pulling new versions as if nothing changed. Opting a package into trusted publishing should be a one-way door that only npm support can reverse, because an attacker with account access can flip a toggle just as easily as a maintainer can. The client could help here too. `npm install` and `npm update` could detect when a package that previously used trusted publishing releases a new version without it, and refuse to update or at least warn. That kind of downgrade in publishing method is exactly the signal that something has gone wrong. ### Cooldowns aren’t on by default npm shipped `min-release-age` in v11.10.0, which lets you refuse to install package versions published within a configurable window. Most malicious versions are caught within the first 24 to 48 hours, so even a modest cooldown would block the majority of supply chain attacks from reaching your project. But it’s off by default, which means the developers who would benefit from it most, the ones running `npm install` without thinking about supply chain security, will never turn it on, because they don’t know it exists. ### npx has no safety net at all `npx` doesn’t use a lockfile. It fetches whatever the latest version of a package is and runs it immediately, with no cooldown and no pinning. If an attacker publishes a malicious version of a popular `npx` target, every invocation from that moment forward pulls and executes the compromised code. The defaults problem is worse here than anywhere else in npm, because `npm install` at least has `npm ci` and `min-release-age` as things you can opt into, while `npx` has no equivalent at all. And `npx` has become the standard way to bootstrap projects and run one-off tools in tutorials, CI scripts, and increasingly in AI coding agents that generate and execute `npx` commands as part of their workflows. ### GitHub Actions as an enabler npm revoked classic tokens in December 2025 and capped granular token lifetimes at 90 days, which reduced the window of exposure from a stolen token. But most npm packages are published from GitHub Actions, where tokens sit in repository secrets, and the 90-day rotation creates enough friction that maintainers look for shortcuts rather than setting up OIDC properly. Shai-Hulud propagated specifically by harvesting tokens from CI environments, and the architecture that made that possible, long-lived secrets stored alongside the code that uses them, hasn’t fundamentally changed even though the individual token lifetimes got shorter. The Trivy supply chain compromise earlier this month showed how this plays out in practice: attackers used a leaked token from a GitHub Actions environment to force-push malicious code to 76 version tags, harvesting secrets from every CI pipeline that referenced them. There’s no confirmed link between that incident and the axios compromise twelve days later, but the attack surface is the same: npm tokens stored in CI environments that become the prize in a GitHub Actions breach. OIDC trusted publishing with no stored tokens is the answer here, and it works today, but npm hasn’t made it the default onboarding path and the setup still requires enough manual configuration that most maintainers haven’t switched. ### npm is the one that matters pnpm, Bun, and Deno have all made better choices about their defaults. pnpm blocks postinstall scripts, Bun requires explicit opt-in for them, Deno’s permission model is restrictive by design. But npm ships with Node.js, and it’s the client that the vast majority of the JavaScript ecosystem actually runs on, so the other clients making better choices doesn’t change the baseline security posture for the millions of projects that use npm because it was already there when they ran `node --version` for the first time. The OpenSSF’s Secure Software Development Guiding Principles set an explicit goal of creating software that is “secure by default,” and their Principles for Package Repository Security lay out maturity levels for registries and CLI tooling. npm has shipped the safer options as flags and config keys, but none of that matters until it changes what happens when someone types `npm install` or `npx` with no flags. npm’s defaults are bad and they have been for a long time. Fixing them would do more for JavaScript supply chain security than any scanner, policy, or post-incident review ever will.

Find a comfortable position. Close your laptop halfway, so the screen light softens but the fan noise continues.1 That hum is your anchor. You will return to it throughout this practice. Take a deep breath in. Hold it. Now run `npm install`. Breathe out slowly as 1,247 packages are added. Do not look at the output. You are not ready. ## Body scan We will begin with a body scan. Bring your attention to the top of your head. Notice any tension you are holding there. This is where you store your awareness of packages that have not been updated in three years but still work. Let it soften. Those packages do not need you right now. They are dormant, the way a perennial is dormant. The roots are still in the ground. There is nothing for you to do until spring, and spring may never come, and that is also part of the garden. Move your attention to your forehead. This is where you hold the memory of every major version bump that removed the one function you actually used. The migration guide was six pages long and the first step was “update your mental model.” Breathe into that space. Release it. You have already updated your mental model. You updated it when you pinned to the previous version and moved on. Now bring awareness to your jaw. You are clenching it. You have been clenching it since the last time you saw `ERESOLVE unable to resolve dependency tree`. Unclench. The tree will not resolve faster because your jaw is tight. The tree may not resolve at all. That is also acceptable. We are practising acceptance today. Feel your shoulders. They have been raised since you read the GitHub issue titled “Is this project still maintained?” posted fourteen months ago with no response. Lower them. The maintainer may be on a goat farm in Portugal. The maintainer may be the goat. You cannot control this. Release your shoulders and release the maintainer. Your hands are hovering over the keyboard. Notice which keys your fingers are drawn to. If they are drawn to the up arrow and enter, you are about to re-run a command that has already failed. This is not mindfulness. This is `while true`. Gently place your hands in your lap. ## Breathing exercise We will now practise a breathing technique calibrated to the dependency lifecycle. Breathe in for four seconds. This represents the planting season, when the package is new and everything works and the README has a row of green badges and the soil is warm. Hold for seven seconds. This represents the long growing season, when issues accumulate faster than they are closed and the CI badge turns grey because the service it was hosted on has itself been abandoned. The plant is alive but nobody is watering it. Weeds are moving in. You can see them in the issue tracker. Breathe out for eight seconds. This represents the harvest and rot, when a blog post titled “Why We Moved Away From X” appears on Hacker News and the comment thread is 400 messages long and the top comment is “I said this would happen two years ago” with no link to the original prediction. Repeat this cycle. In for four. Hold for seven. Out for eight. If you lose count, that is fine. Counting is implemented differently across locales and your breathing may be lexicographically sorted. ## Visualisation Close your eyes. You are standing in a garden. This is your project. You planted some of what grows here, chose it carefully, read the labels, checked the light requirements. But most of what you see was not planted by you. It arrived as seeds carried inside other plants, hidden in the root ball of a package you selected for its flowers without thinking about what it would bring with it. This is transitive dependency. Every garden has it. You are not a bad gardener. You are a gardener. Walk deeper into the garden, past the border plants you recognise and tend. Past the mid-layer shrubs whose names you have seen in your lockfile but never looked up. Keep walking until you reach the back fence, where the growth is dense and tangled and the packages are maintained by a single person in a different timezone whose GitHub profile picture is a sunset from 2016. Look down. The soil here smells faintly of sulfur. This is normal. The sulfur is coming from a transitive dependency six levels deep that pulls in a native binding to a C library that was last updated during the Obama administration. The binding works. Nobody knows why. Its roots have grown into your foundation in ways that would be unwise to investigate. Sit with this. Breathe. Every garden has something growing behind the shed that you have decided not to identify. Now, from this place of stillness, I want you to visualise a yellow advisory banner. It says `3 moderate severity vulnerabilities`. Do not open your eyes. Do not run `npm audit fix`. The fix will update a package that will break a peer dependency that will cascade through your lockfile like pulling a weed whose roots have wrapped around everything else in the bed. You know this because you have done it before. Instead, observe the advisory. Let it be. Moderate severity means someone could theoretically exploit a ReDoS in a markdown parser if they controlled the input and had four hours and very specific motivations. This is not your concern today. ## Mantra Repeat after me, silently, in the voice of your internal monologue: _I accept the packages I cannot update._ _I accept the breaking changes I cannot predict._ _I accept that`node_modules` is larger than my application and always will be. The undergrowth is always larger than the tree._ _I accept that the package I depend on depends on a package that depends on a package whose maintainer closed all issues with the message “I am mass-closing issues. If your issue is still relevant, please re-open it,” and then transferred the repository to an organisation with no other public repositories._ Breathe. _I accept that`--legacy-peer-deps` is not a solution. It is a coping mechanism. I am at peace with my coping mechanisms._ _I accept that somewhere in my lockfile there are two versions of the same package and they are both wrong. Two plants with the same name that fruit differently. I will not dig them up today._ ## Letting go You carry your dependency tree with you when you leave your desk. You carry it into the shower, where you think about whether that package you added last week is still maintained. You carry it to bed, where you wonder if the lockfile you committed on Friday will still resolve on Monday. You carry it to dinner with friends, where you do not mention it, but it is there, a background process consuming resources, never quite idle. Notice this. You are anxious about code that is not running. You are worried about packages that are sitting in a registry, unchanged, doing nothing. The vulnerability you read about on Tuesday has not been exploited. The deprecation warning you saw has no deadline. The package whose maintainer went quiet is still working, today, right now, exactly as it was when you chose it. Nothing has happened. You are holding tension for things that have not happened yet and may never happen. Put the garden down. You are not in the garden right now. The garden does not need you at midnight. The weeds will not grow faster because you are thinking about them. The frost will not come sooner because you are watching the forecast. Your dependency tree is a text file on a server and it will be the same text file tomorrow morning. Breathe in. You are not on call for your lockfile. Breathe out. The packages can wait. They have always been waiting. That is all they do. ## Guided acceptance: the six dependency griefs **Version conflict.** Two packages in your tree require different major versions of a third package. You cannot have both. You cannot have neither. You can have one if you alias the other, which means your application will ship two copies and they will not share state and something will break at runtime in a way that no type checker or linter will catch. Observe this situation. Do not try to fix it. It was not introduced by a person. It was introduced by time. Time moved the versions apart the way two branches of the same tree grow in different directions, slowly and without malice, until they are reaching for different light entirely and you are the trunk expected to feed them both. **Abandonment.** A package you depend on has stopped growing. The last commit was a Dependabot PR that was never merged. The README still says “PRs welcome!” in a way that now reads as historical document rather than invitation. You could fork it. You could tend the fork. You could become the person whose GitHub profile picture is a sunset, who mass-closes issues, who gets emails from strangers asking why the leaves are brown. Sit with this. The package gave you what it could for as long as it could. Send it gratitude. Let it decompose. The nutrients will feed the next thing that grows in that spot. **The phantom dependency.** Your application works in development but fails in CI because you are relying on a package that you never declared as a dependency. It is installed because another package depends on it, and your package manager hoists it to a location where your code can reach it, and you imported it eighteen months ago without realising it wasn’t yours to import. You have been eating fruit from your neighbour’s tree, the branch that overhangs your side of the fence, and now your neighbour has cut the branch. The phantom dependency is a lesson in impermanence. Acknowledge it. Plant your own. Or don’t. Either way you are choosing a form of suffering, and choosing is itself a practice. **The security advisory that does not apply.** You have received a security advisory for a vulnerability in a package you use. The vulnerability is in a function you do not call, in a code path you do not exercise, in a scenario that requires an attacker to control a YAML parser’s input while running as root on a machine that accepts unsigned certificates over an unauthenticated HTTP endpoint. The advisory is marked Critical. Your security dashboard is red. Your compliance team has opened a ticket. The fix requires upgrading to a version that drops support for the Node.js version you are running in production. Breathe in. This is suffering caused by metrics. A garden inspector has told you that one of your plants is on a list of invasive species in a country you do not live in. The metric says you are insecure. You are not insecure. You are measured. **The merge conflict in the lockfile.** Two branches have grown toward the same light and met in the middle. You and a colleague both updated dependencies, and now the lockfile has 4,000 lines of conflict markers. You will not read them. Nobody reads them. The lockfile is not meant to be read by humans, which is why git insists on showing it to you in a format designed for humans to resolve. This is a tangled vine that cannot be unknotted, only severed and replanted. Run `git checkout HEAD -- package-lock.json` and then `npm install` and let the tree grow back from your side. Your colleague’s changes will need to be re-resolved. This feels wasteful. It is wasteful. Gardening is mostly waste. Seeds that don’t germinate, cuttings that don’t take, entire seasons of growth pulled up because something else needed the space. Release the guilt. Delete the conflict. Begin again. **The everything update.** It has been eight months since you last tended your dependencies. You have been meaning to. The longer you wait the harder it gets, and the harder it gets the longer you wait, and this recursion has no base case. Today you run `npm outdated` and the output is longer than your application. Thirty-seven packages have new major versions. The changelogs reference other changelogs. The migration guides assume you completed the previous migration guide. You are four migrations behind. This is the garden you left over winter. The gate is stuck. The paths are overgrown. Something has built a nest in the trellis. Observe the fear. Name it. It is called “I am going to spend three days on this and my application will behave exactly the same when I am done.” That is correct. It will behave exactly the same. That is the practice. Maintenance is a meditation on impermanence disguised as wasted effort. The garden does not look different after you weed it. But you were there. Your hands were in the soil. That is enough. ## Closing Bring your awareness back to your breath. Back to the hum of your laptop fan. Notice that it is louder now. Something in your `node_modules` has triggered a post-install script that is compiling a native module. Or mining something. You cannot know which from the sound alone, and knowing would not change the sound. Listen to the gentle sound of endless blocks being chained together. Let it run. You agreed to this when you ran `npm install`. You agree to it every time. Whatever is happening in that process is happening now, and it will finish when it finishes, and what will be will be. When you are ready, open your eyes. Open your laptop fully. Look at your terminal. If there are warnings, let them scroll past. They have always been scrolling past. You have always been here, in this garden, between `npm install` and the next breaking change, tending what you can and accepting what you cannot. Go gently. The growing season is long and the soil does not care about your deadlines. * * * _This meditation was tested on Node.js 18, 20, and 22. Results may vary on earlier versions due to a breaking change in the`--harmony-weakrefs` flag that affects garbage collection of abandoned inner peace. If you experience dizziness, ensure your lockfile is committed and try again after clearing your module cache._ 1. If you have a fanless Mac, this website will provide a suitable imitation. Match the volume to whatever feels grounding. ↩