It’s really only a web of trust in a very naive sense. Most JS OSS is MIT licensed. There are no guarantees. It’s on _you_ to ensure the software works. Secon

It’s really only a web of trust in a very naive sense. Most JS OSS is MIT licensed. There are no guarantees. It’s on _you_ to ensure the software works. Secondly people don’t really “trust” packages. They trust the usage, weekly downloads and quality of docs. They just assume this implies that it’s going to be OK, or that when deps break it’s nobody’s fault. Shit happens.