This [1], discussed in another thread is an incredible summary of the issues; I hadn't even thought about packages that are required by other packages; it can l

This [1], discussed in another thread is an incredible summary of the issues; I hadn't even thought about packages that are required by other packages; it can lead to literally thousands of deps :-o. Node/npm and the web need a standard library that can be included piecemeal, from a well trusted source and packages that only depend upon this small subset should be highlighted. require('std/string/pad'); [1] http://lucumr.pocoo.org/2016/3/24/open-source-trust-scaling/ http://lucumr.pocoo.org/2016/3/24/open-source-trust-scaling/