3 ms·
I truly don’t understand trusting anything from a package manager. Download the code. Read through it. Then host it on your own server and manually include it.
by irrational 5y ago
I truly don’t understand trusting anything from a package manager. Download the code. Read through it. Then host it on your own server and manually include it. Anything else is pure insanity to me.
- fault1 5y agoThe problem with npm is that you'll have to read a LOT of transitive dependencies. There is a reason why there is a large cottage industry doing security scanning of npm deps. In the end it all depends on who you trust.