I'm not finding this article substantive, it appears to be trying to pick a fight for its own sake rather than adding anything new or interesting to the broader

I'm not finding this article substantive, it appears to be trying to pick a fight for its own sake rather than adding anything new or interesting to the broader discussion around package security. I haven't seen data that suggests that NPM malware is more common than most other package managers when you adjust for relative size and rate of new packages. It's not clear to me how any of the suggested changes that the author proposes would have stopped the last attack, since it likely involved a package author deliberately sabotaging their own package. The author ignores any of the technical considerations as to why standard libraries are kept small in Javascript. It's an oversimplification of an extremely complicated topic. Javascript has concerns that languages like Python, Ruby, and PHP don't -- namely backwards compatibility and the inability to correct bad decisions once they've been made. The article is filled with claims that just don't make sense or are outright wrong (unpublishing packages is already not allowed on NPM). I want to assume the author does actually have experience on the web, and they're not just mad that Javascript/Node exists -- so from a charitable interpretation, this article could have done more to dig into why the recent NPM scare is fundamentally different from similar situations that have popped up recently in, say, Ruby Gems[0]. [0]: https://gbhackers.com/rubygems-strong_password/ https://gbhackers.com/rubygems-strong_password/