I understand the concerns but it’s a risk most projects are willing to accept. Automated builds should use ‘npm ci’ to use the exact versions. If a developer

I understand the concerns but it’s a risk most projects are willing to accept. Automated builds should use ‘npm ci’ to use the exact versions. If a developer goes crazy and push broken updates, it has been reversed and made the front page of most IT news websites in the past. The supply chain of software rely on so many things. It’s impossible for anyone to trust everything. I don’t trust OpenSSL for security, the Linux kernel still doesn’t have unit tests as far as I know, my intel CPU is a black box with proprietary microcode that is known to allow network access to anything , so many tiny libs in C are half maintained,… left-pad being offline for a few hours many years ago or fakers doing an infinite loop in one promptly removed release last year are not preventing me to sleep.