The moral of story of leftpad should not have been people use too many dependencies. It should have been don't arbitrarily grab code from the web for your prod

The moral of story of leftpad should not have been people use too many dependencies. It should have been don't arbitrarily grab code from the web for your production apps. If you had any form of caching where a validated library (i.e. leftpad) would be used for your builds instead of just reaching out everytime then your system wouldn't break. Nor would a random cryptominer get into your app. -- Libraries should be a good thing in that it's definitely easier to review a line of code for a bug than write that same line bug-free. Of course, people (companies) rarely review the libraries they use (sometimes they physically/legally can't) so there are some outs.