A perfect example of this is the Hot Pockets deal. Some guy made a cookie session middleware called node-yummy, which eventually became a dependency of Express

A perfect example of this is the Hot Pockets deal. Some guy made a cookie session middleware called node-yummy, which eventually became a dependency of Express. Express has a bajillion downloads, so yummy up and brokered a deal by which on every install they tweeted a like for Hot Pockets. So, Hot Pockets really started soaring, with no one having any idea what they were tweeting by installing and updating Express, until someone ruined all the fun by posting it on Medium, and getting picked up by HN [2] IMO the really not acceptable part is that the open souce projects are not being pulled from Github. When something claims to be open source, we should have a gaurantee from NPM that we can see the source. The current setup implies the opposite [1] https://github.com/defunctzombie/node-yummy/issues/7 https://github.com/defunctzombie/node-yummy/issues/7 [2] https://medium.com/friendship-dot-js/i-peeked-into-my-node-modules-directory-and-you-wont-believe-what-happened-next-b89f63d21558 https://medium.com/friendship-dot-js/i-peeked-into-my-node-m...