Maybe... it depends on the amount of _trust_ that you put in the remote domain. My prediction is that the Deno ecosystem will aggregate around a few, large repositories that will have good guarantees araound immutability and good track records to addressing vulnerabilities.

For large projects like React, lodash, eslint whatever, I expect some of them will start hosting their libraries on their own networks, like it used to be when Javascript was only frontend and you would have a script tag importing jQuery directly from jQuery's CDN. The reason it worked was because jQuery was sidely known and trusted.

Whot? How is that even comparable? It's third party code after all, the same happens when you use a library in any other language

A library in any other language is saved local and built with your project.

My understanding is these are loaded from URLs if they are not in the cache. If a domain changes hands, you could be served anything.

Presumably you’d use deno bundle for a production build so you’re not directly using the source files.