If you're doing frontend stuff and are adding a bunch of assets hosted off a CDN, you can use Subresource Integrity[0] to ensure the JS file is not tampered wit

If you're doing frontend stuff and are adding a bunch of assets hosted off a CDN, you can use Subresource Integrity[0] to ensure the JS file is not tampered with in any way. All it takes is some rogue developer to alter the code of JS used on 1M+ sites to do cryptomining or siphon personal data or do XSS. I know, it's not NodeJS/npm I'm talking about here. npm/Node needs its own resource integrity type feature where we can cryptographically verify the integrity of packages against a known-good library of packages. [0] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...