News for hackers. Stuff that matters.

A comment on Deno 1.0. Parent comment

Re:Deno 1.0 by sakarisson on Thursday May 14, 2020 @01:33AM (#23175707)
My least favorite thing about importing from NPM is that I don't actually know what I'm importing. Sure, there might be a GitHub repository, but code is uploaded to NPM separately, and it is often minified. A malicious library owner could relatively easily inject some code before minifying, while still maintaining a clean-looking repo alongside the package.

Imports from URL would allow me to know exactly what I'm getting.

[ Parent | on HN ]
Re:Deno 1.0 by _630w on Thursday May 14, 2020 @02:48AM (#23176219)
install from the repo then?

You can install a specific version from git via yarn/npm.

How do you trust a url more without reading the code?

What's going to stop deno ecosystem from putting minified js files on cdns and import them?

[ Parent | on HN ]