Yep I've been trying to get our company to pay more attention to it. It's not just nodejs. All the new hipster languages pull in whatever they can grab. Python,

Yep I've been trying to get our company to pay more attention to it. It's not just nodejs. All the new hipster languages pull in whatever they can grab. Python, golang, Ruby.. A lot of this stuff is submitted by random people that have no verified credibility. It's really worrying. I'm sure it'll take another major incident though before we'll really pay attention to it. Like wanna cry/notpetya did for SMBv1. Because the devs don't want any mitigations, it'll make their work more difficult.