2 ms·
On top of what's been already mentioned, a lot of people are starting to not trust NPM because it is a for profit business, dependant on investor's money. It mi
by iraldir 7y ago
On top of what's been already mentioned, a lot of people are starting to not trust NPM because it is a for profit business, dependant on investor's money. It might not be here forever, it might be bought by some other actor etc.
It's also a giant attack vector. Create a popular package or buy or get ownership from a developer of a package, and you can easily hide code in the mified deployed build while not having in the source code. Using complexe hiding methods, you can hide code in a subsubsub dependency of something that will, say, copy input fields and send them via XHR, every 100 times and not when debugger tools are open, or only when you detect you are in a country where the targeted developer is not located etc. Even worse for nodejs libraries.