NPM can specify GitHub URLs as dependencies, so I don't see how this is a problem exclusive to Deno and not Node. Also, this problem can be mitigated by static

NPM can specify GitHub URLs as dependencies, so I don't see how this is a problem exclusive to Deno and not Node. Also, this problem can be mitigated by static analysis. No reason why a pre-push hook can't look at all the import identifiers and restrict them to a whitelist of domains. But having mentioned this before in another recent thread about Deno, some people are under the impression that statically analyzing imports is really hard, despite how even a junior engineer could figure it out with an AST parser in a day.