Totally agree on the ecosystem being problem number one. A ton of modules that depend on a ton of other modules, poorly coded, not maintained, not tested. Put

Totally agree on the ecosystem being problem number one. A ton of modules that depend on a ton of other modules, poorly coded, not maintained, not tested. Put on top the fact that NPM doesn't want to deal with version conflicts and installs 173 versions of the same package and you get a huge directory full of security warts.