> At the very least, it takes them under a minute to break your app, simply by deleting their package. Not really, if you pin your versions exactly and don't d

> At the very least, it takes them under a minute to break your app, simply by deleting their package. Not really, if you pin your versions exactly and don't do auto-updates. This also means that you have to update your packages manually and inspect what the latest versions are doing -- which is good practive anyway. NPM packages can not be depublished any longer as far as I know.