News for hackers. Stuff that matters.
Re:Polyfill supply chain attack hits 100K+ sites by josephg on Tuesday June 25, 2024 @04:45PM (#40793382)
Yep. And so does unpkg. If you’re using JavaScript code through unpkg, you’re still using npm and your code is still bundled. You’re just getting someone else to do it, at a cost of introducing a 3rd party dependency.

I guess if your problem with npm and bundlers is you don’t want to run those programs, fine? I just don’t really understand what you gain from avoiding running bundlers on your local computer.

There are no comments on this comment yet.