I wish the conclusion would be different. The frontend javascript ecosystem can only be described as deranged. If anything, it's a miracle that malicious packa

I wish the conclusion would be different. The frontend javascript ecosystem can only be described as deranged. If anything, it's a miracle that malicious packages don't happen more often than they do. One of my side projects has over 1000 indirect dependencies (according to ls -l .yarn/cache | wc -l), and it's not a project I'd consider especially fancy. Alacritty has 200 indirect dependencies, and as far as I've seen that's the upper bound for most rust projects. For NPM, it's the lower bound. Running yarn in firejail/bwrap helps, but it's not easy to set up and sandbox escapes can happen (same with docker).