> I have been writing for years that package managers are a big security risk Like all tools used by humans, package managers are used for great good, and terr

> I have been writing for years that package managers are a big security risk Like all tools used by humans, package managers are used for great good, and terrible evil. The great good (from a security point of view) is that we can distribute new features and patches quickly and freely. The bad: we can distribute nefarious code just as easily. > Or just write it yourself. Writing code is how bugs are created. Often popular libraries are much more robust and secure than bespoke code. Sometimes they are not. > Learn what your code base does. Great advice.