Dominic is a prolific contributor and compassionate leader in the JS and P2P communities - and it was a disheartening thread to read. The suggestions that he (w

Dominic is a prolific contributor and compassionate leader in the JS and P2P communities - and it was a disheartening thread to read. The suggestions that he (working for free!) should have done more seemed unfair. We should look to fix these: - If we're going to rely on hundreds of packages per project, we need fine grained security like Android or iOS. deno seems to be doing node right - https://github.com/denoland/deno/issues/171 https://github.com/denoland/deno/issues/171 - Lock down versions for now. Use 1.2.1 instead of ~1.2.1 or ^1.2.1. - If npm must remain at the center of node's module system, they might have to add auditing and approval tools. 'npm install' can warn about unaudited modules. The problem with that is that it will make npm (a business) even more central to the node ecosystem - which may not be a good thing.