I still think that sandboxing dependencies is the wrong answer to this problem. (first - the problem is trusting dependencies. How to spot malicious code in a

I still think that sandboxing dependencies is the wrong answer to this problem. (first - the problem is trusting dependencies. How to spot malicious code in a dependency, and stop an evil upstream maintainer from doing bad things to your site) This solution slows down the system at run-time (and also never quite solves the problem - sandboxes are pretty leaky. The history of browser extensions trying to do the same thing is a good example). I'm not really sure what the solution is. I have some ideas, but they're mostly about changing the culture around coding, rather than technical.