> Will that not just bring about another npm situation in a few years? Speaking of which, I was wondering if it has an equivalent for "npm audit", and I've fou

> Will that not just bring about another npm situation in a few years? Speaking of which, I was wondering if it has an equivalent for "npm audit", and I've found a project which provides some of that capability: https://deno.land/x/audit@1.0.0 https://deno.land/x/audit@1.0.0 Rather than rely on a single source of truth for audits, it seems to rely on developers specifying a location which is trusted to make audit reports about their modules. That's a slightly different trust model, but it's better than nothing and at least prevents the controversial false positives problem of "npm audit": https://news.ycombinator.com/item?id=27761334 https://news.ycombinator.com/item?id=27761334