A minor update to one small npm package threw the entire npm ecosystem into chaos, affecting millions of JS projects. The library is called is-promise — two lines of code that other projects can call in a single line, letting developers test whether a JS object is a Promise. Despite being just two lines, it’s one of the most popular npm packages, used by over 3.4 million projects. Because it didn’t conform to the correct ES module standard, other projects depending on it started failing at build time. Many well-known JS projects were affected.