Trust is non-binary. It is a perfectly legitimate concern that npm dependencies are a threat vector. Obviously, at build time - but we've all heard stories how

Trust is non-binary. It is a perfectly legitimate concern that npm dependencies are a threat vector. Obviously, at build time - but we've all heard stories how less security conscious developers let malicious code slip through with just `npm update`. And compared to, e.g., C++ tooling (npm) makes it somewhat easier to slip a malicious update through. So it's not like that's strictly incorrect. The concern is that is not exactly clear what processes AgileBits have in place and how they manage those dependencies. They could - and probably do - things the proper way (private registry for all dependencies, etc), but the concern is that they're accidentally missing something is perfectly valid - albeit voiced incorrectly (as a statement that it is insecure, not a question whenever they do things in a secure manner). Brain farts just happen, even to the very best developers and teams.