GoKawiilDeveloper deprecates decade-old PHP polyfill package with 20 million installs
A developer who wrote a 174-line PHP polyfill in 2014 as a temporary fix for AOL's content management system has now marked the package as deprecated. The code, originally meant to replace a deprecated function from the pecl_http extension, was shared on Packagist and has since been installed nearly 20 million times, with over 400,000 installs still occurring monthly. It also spread indirectly through WPML, idna-convert, SPIP, and Linux distributions like Debian and Ubuntu.
GoKawiil's interpretation of the reporting above, not reported fact.
This case illustrates how small, informal open-source contributions can become deeply embedded in critical infrastructure without their original authors realizing the scale of dependency. It highlights the fragility and hidden risk in modern software supply chains, where a quick fix from over a decade ago can end up powering millions of websites through layers of indirect dependencies.
- A 2014 stopgap PHP polyfill has been installed nearly 20 million times via Packagist.
- The code spread indirectly through major projects like WPML, SPIP, and Debian/Ubuntu packaging.
- The maintainer has now deprecated the package after realizing its unexpectedly massive reach.
Source: jakeasmith.com, 2026-09-15
Published there as: “My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.