>but we all remember the left-pad incident, right? It proved that having lots of dependencies might actually not be the best thing. npm no longer allows depend

>but we all remember the left-pad incident, right? It proved that having lots of dependencies might actually not be the best thing. npm no longer allows dependencies to be unpublished after they've been up for 24 hours. The issue that happened with left-pad was solved. It's possible for someone to instead publish a new non-functional version of a package, but I don't think that's unique to npm, and that won't affect people who have pinned to a specific version of the package.