A couple points: 1. The npm 2 model breaks down for client-side applications where you want to minimize the size. I don't want 5 slightly different versions of

A couple points: 1. The npm 2 model breaks down for client-side applications where you want to minimize the size. I don't want 5 slightly different versions of left-pad when 1 will do. 2. I think of semver ranges in package.json as expressing what versions the developer believes should work, and npm-shrinkrap.json or yarn.lock as expressing the latest versions that have actually been tested. I think it's insane to use npm without shrinkwrap (even though it has its own problems). One of the best things about yarn is it generates yarn.lock by default. I suppose this view is problematic in the context of RunKit which doesn't have any sort of lock file, and would be challenging to implement UX-wise. 3. Packages with known security issues should be marked as deprecated, which will cause a warning to be printed every time it's installed. Malicious packages can do a lot worse things than forcing another package's dependency to a specific version, though that is a particularly subtle attack.