3 ms·
Right. The scary part is not code you're running can do something bad. Of course it can. It's that given the depth of the dependency trees, I don't have any co
by coffeefirst 6y ago
Right. The scary part is not code you're running can do something bad. Of course it can.
It's that given the depth of the dependency trees, I don't have any confidence we can tell the difference between trustworthy and untrustworthy packages.
- turminal 6y agoGiving up sadly appears to be the only option for most use cases of npm and the like.