Re:Polyfill supply chain attack hits 100K+ sites
by spankalee on Tuesday June 25, 2024 @04:18PM
(#40793108)
npm is a package manager though, not a build system. If you use a library that has a dependency on another library, npm downloads the right version for you.
[ Parent
| on HN ]
Re:Polyfill supply chain attack hits 100K+ sites
by josephg on Tuesday June 25, 2024 @04:45PM
(#40793382)
Yep. And so does unpkg. If you’re using JavaScript code through unpkg, you’re still using npm and your code is still bundled. You’re just getting someone else to do it, at a cost of introducing a 3rd party dependency.
I guess if your problem with npm and bundlers is you don’t want to run those programs, fine? I just don’t really understand what you gain from avoiding running bundlers on your local computer.