If you explicitly requesting a particular version, that mitigates the security concerns to some degree (though as this incident proves, you are still reliant on

If you explicitly requesting a particular version, that mitigates the security concerns to some degree (though as this incident proves, you are still reliant on that version being published for proper functionality). That said, the fact that npm's blog [0] indicates that a republished package (with a new version number) mitigated the issue to some degree, and this comment [1] suggesting that the default behaviour is to get the latest minor release, makes me wonder how widespread of a practice that is in reality. [0] http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm [1] http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-program/#comment-127246 http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how...