> peoples dependencies keep getting updated. Updated maybe with malware sometimes? Is it unbelievable that the admins sometimes would hand over an inactive mod

> peoples dependencies keep getting updated. Updated maybe with malware sometimes? Is it unbelievable that the admins sometimes would hand over an inactive module to the wrong person? Maybe Perl is a less interesting target than npm so it works (so far) for them?