3 ms·
My least favorite thing about importing from NPM is that I don't actually know what I'm importing. Sure, there might be a GitHub repository, but code is uploade
by sakarisson 6y ago
My least favorite thing about importing from NPM is that I don't actually know what I'm importing. Sure, there might be a GitHub repository, but code is uploaded to NPM separately, and it is often minified. A malicious library owner could relatively easily inject some code before minifying, while still maintaining a clean-looking repo alongside the package.
Imports from URL would allow me to know exactly what I'm getting.
- searchableguy 6y agoinstall from the repo then? You can install a specific version from git via yarn/npm. How do you trust a url more without reading the code? What's going to stop deno ecosystem from putting minified js files on cdns and import them?