As we have seen all too many times, these things are not guaranteed. The repository can be down. Semantic versioning might not be specified correctly. Packages

As we have seen all too many times, these things are not guaranteed. The repository can be down. Semantic versioning might not be specified correctly. Packages might be transferred to a new maintainer who then abuses them to deliver malicious payloads. Or the package you pick might simply have bugs. Fair enough, most of those are legitimately risks of external code that doesn't apply to internal code. However, I object to object that nobody writes bug-free code so the possibility of my chosen package having bugs isn't such a case. > I can see no basis for that assumption in the world of JS and NPM I overstated my point there. > Giants like react have been brought down by tiny packages like left-pad. Its a nit-pick, but react wasn't broken by left-pad. Babel was broken which is almost always used with react.