There’s already a trust vector between the people shipping all the tiny little pieces of garbage JS, and then on to the binaries that read and handle dependency management, and packaging, and so on-things which, as has been expressed, seem to be in a rolling two-years-or-less handbasket to at least “mess”, if not “hell”.

We’re already to the point where “no one” audits the code base, tooling, or dependencies. Especially the dependencies.

I really don’t think deserializing the file is that sketchy. It’s really not hard to implement a parser if the format isn’t garbage