3 ms·
If you expect a developer to review every line of code of every version of every module all the way down the NPM dependency tree then we can forget about anyone
by TobyTheDog123 5y ago
If you expect a developer to review every line of code of every version of every module all the way down the NPM dependency tree then we can forget about anyone ever completing a project.
There are other solutions.
- megous 5y agoYou don't need to review every line. Just general code quality, and search for obvious obfuscations/or things like these.
- dsQTbR7Y5mRHnZv 5y agoSimply instantiating a React project with `create-react-app` generates a lock file with over 1300 transitive dependencies: $ npx create-react-app sample-app $ cd sample-app $ cat package-lock.json | jq '.packages | length' 1393 Expecting all developers (including those new to the field) to manually audit each and every one of these packages simply isn't feasible.