It's malicious. That being said, I always get pushback when I mention this but I think SaaS projects should often be vendoring dependencies. It's safer, it's m

It's malicious. That being said, I always get pushback when I mention this but I think SaaS projects should often be vendoring dependencies. It's safer, it's more secure, it gives you more consistent installs -- and it prevents `leftpad` scenarios. It makes source control slightly more complicated, but the other benefits (often) greatly outweigh that. This is something that used to be more commonplace in the Javascript community, and it's something that `node_modules` makes very easy, but it's fallen out of style in modern web development. To the best of my knowledge, this was also commonplace in the original design of Go, since it was coming out of Google, which does vendor all of its dependencies. I'm not sure which way the current Go community leans.