3 ms·

I suppose this is hard in NPM. For example of I have a project with 5 dependencies, this explodes to hundreds of tiny projects. These individual projects are a

by Ayesh 8y ago

I suppose this is hard in NPM. For example of I have a project with 5 dependencies, this explodes to hundreds of tiny projects. These individual projects are almost always just a few lines of code, and there's no way anyone's going to become a donor for them. Many major projects are well funded (webpack, etc), but all it takes is one of those tiny packages to send a malware.

onion2k 8y ago
That isn't a problem. You pay the maintainers of the packages you use, and they pass on some of that money to the maintainers of the packages they use. If a problem like this one happens they'll lose a lot of customers, so they're incentivized to audit the code they're pulling down. You only need to worry about the level immediately below yours.