Welcome, I have published a package to the registry called , let me explain why I did this and what happens next. dummy npm cli-pbar Backstory A few years ago, I published some packages to npm and tried their search to see if my packages were popping up in the results. I could find my packages somewhere around the 5th results page. So, I thought there were packages that were more eligible than ours. Later, sometimes, even after consistent package maintenance and applying the appropriate search keywords, it doesn't work either. Still, my packages are behind many pages. Problem with Search Later, I found there are problems with the NPM search scores. The following are my observations: The inefficient quality score calculations. Minified code pkgs scores are lowered. The dependencies must be up-to-date, even if you don't need it. The pkg must have a custom website to get a higher score. Scores may be lower if your pkg is not in SemVer major release. Not considering pkg provenance. The unknown mechanism for code complexity measures. The Dummy Package Now I wanted to test the npm's . Package search rank criteria As the npm's says: docs Quality includes considerations such as the presence of a README file, stability, tests, up-to-date dependencies, custom website, and code complexity. I created a dummy package named of our organization original package with all the following requirements: cli-pbar opentf/cli-pbar ✅ README file ✅ Stability - Released Major SemVer ✅ Tests - Added dummy tests ✅ Up-to-date Dependencies - Zero dependencies ✅ Custom Website - Pointed to our Organization website ✅ Code Complexity - Single file with just a index.js console.log() The Result Now, when I again tried with the same search keywords, the experiment got surprising results. Guess what? 🎉 Now our dummy package is featured in the first page that is also within the top 10 packages. https://www.npmjs.com/search?q=cli progress Conclusion This is just an experiment and no intention to spam the registry. I had discussions with the npm team about this; they are aware of this and planning to remove the score, and I hope they wil fix it ASAP. PQM l https://github.com/npm/feedback/discussions/1104 Other related discussions: https://github.com/npm/feedback/discussions/66 https://github.com/npm/feedback/discussions/1043 😂 : Someone cloned my pkg and published it under a different scope; that pkg features on top of my original package in the search results. Fun Fact Let me know your comments please. 🙏 Thanks for reading.

The code in this story is for educational purposes. The readers are solely responsible for whatever they build with it.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

Too Long; Didn't Read

Making security fun one episode at a time

I Published a Dummy Pkg to NPM, and Here is What Happened

Too Long; Didn't Read

Thanga Ganapathy

STORY’S CREDIBILITY

Code License

Guide

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

I Published a Dummy Pkg to NPM, and Here is What Happened

Too Long; Didn't Read

Thanga Ganapathy

STORY’S CREDIBILITY

Code License

Guide

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

RELATED STORIES