Why tie your application to a distribution? You're at the mercy of package maintainers, or you'll end up using docker to do package management in a safe way. Th

Why tie your application to a distribution? You're at the mercy of package maintainers, or you'll end up using docker to do package management in a safe way. There's 0 ways to ensure that installing your required dependencies yesterday and tomorrow on a fresh install of Debian won't differ in a critical way? You could do that with NixOS, but I doubt that's the OS/package manager of choice for the target audience of Hare. Relying on OS package managers is partly why docker became popular, far more than most of the designed features of docker and the respective kernel features. The fundamental issue with security of NPM is the same issue you encounter in any package manager, you have to trust the maintainers. It's harder to trust a larger group of people than a smaller group of people. I'd argue the better solution with NPM is to choose libraries more deliberately and monitor your dependency graph instead of stopping to use NPM altogether.