The node development environment is bananas. On the web, executing third-party controlled JS code is considered a profound (XSS) vulnerability, despite browser

The node development environment is bananas. On the web, executing third-party controlled JS code is considered a profound (XSS) vulnerability, despite browsers being equipped with the strongest sandboxing. Tiny cracks are leveraged into click fraud, cryptocurrency mining, and other nefarious activities. Meanwhile website build processes indiscriminately pull in random modules and their transitive dependencies. Modules may inadvertently stumble into a core role, like left-pad. Popular Chrome web extensions get large monetary offers, and npm modules are surely next in line (if it's not already happening).