News for hackers. Stuff that matters.

A comment on The State of JavaScript 2018. Parent comment

Re:The State of JavaScript 2018 by addicted on Monday November 19, 2018 @10:44AM (#18487153)
The leftpad fiasco (which I believe NPM has now mitigated), and the recent security issue where a certain popular package was uploading any passwords it found showed the current dangers with NPM.
[ Parent | on HN ]
Re:The State of JavaScript 2018 by erik_seaberg on Monday November 19, 2018 @04:27PM (#18489894)
The lesson from left-pad should have been to vendor all your deps rather than bet your org on third parties with no SLA commitment to you.
[ Parent | on HN ]
Re:The State of JavaScript 2018 by untog on Monday November 19, 2018 @11:14AM (#18487403)
I'm not arguing about the security of NPM, rather the idea that multiple modules is a bad thing.
[ Parent | on HN ]