All guides

What to check before you buy someone else’s code

5 min read·

The listing is marketing. The package is the product.

Everything on a listing page was written by the person selling it. That is not a criticism, it is what a listing is for. But it means the parts of it that predict your experience are the ones the seller had least freedom over.

Screenshots, feature lists and adjectives are free to produce. What costs the seller something is a real changelog, a version history, a specific licence, and a description that names what the package does not do.

The five minutes that matter

In rough order of how much each tells you per second spent.

  • Does the description say what it does not cover? A seller who writes "this does not restyle your existing theme, you point your own CSS at the tokens" has used the package. One who lists only capabilities may not have.
  • Is there a version other than 1.0.0? A second version means somebody found something and the seller fixed it, which is more informative than any first release.
  • What licence, exactly? "MIT" is a licence. "Commercial use allowed" is a sentence. If you are shipping it to clients, you need to know which one you bought.
  • Does the preview code look like the description? A preview showing a tidy helper function attached to a listing promising a full integration is a mismatch worth asking about.
  • What happens when it breaks? Not whether it will, because it will. Whether there is a route that ends in a fix or a refund, and how long that route takes.

Things that look like signals and are not

Sales counts on a new marketplace mean almost nothing, and every marketplace is new once. A rating with three reviews behind it is three people, not a consensus. A polished landing page tells you the seller can make a landing page.

The one that misleads most is a long feature list. Features are cheap to list and expensive to maintain, and a package advertising thirty of them is usually telling you where its attention was divided rather than where its quality is.

And afterwards

Read it before you run it, and read it before an agent does. If the package is worth buying it is worth ten minutes of opening files, and those ten minutes are also when you find out whether the code is written the way you would want to maintain it.

That is the check nobody can do for you, and it is usually the one that decides whether the purchase was worth it.

Every package on this marketplace is checked for exactly this before it can be listed, alongside malware, build-breaking errors and copied work.