Consider a runtime like Microsoft's .NET: - The standard base class libraries with .NET are quite comprehensive; I end up rarely adding "utility" libraries

Consider a runtime like Microsoft's .NET: - The standard base class libraries with .NET are quite comprehensive; I end up rarely adding "utility" libraries - For non-standard libraries, Microsoft is a first party publisher of many packages on nuget; many of their first party frameworks and tools are published this way - For third-party libraries, generally speaking, I end up using maybe a dozen or so very well-known and well-vetted libraries which have low dependencies of their own (again, because of the rich standard libraries) - You end up with far less surface area for dependency chain attacks According to the 2020 State of the Octoverse report [0]: - Node projects had nearly an order of magnitude more transitive dependencies than the next highest (683 to 70 for PHP) (p.11) - npm had the highest percentage of critical and high severity advisories (p.14) - 72.8% of JavaScript repos had dependabot alerts (well above the weighted average of 59%) compared to 6.5% for .NET and 40.2% for Java Some would say that Microsoft's stewardship of .NET and C# is a negative; it can never be truly OSS. The flip side of that is that there is a professional team of paid software engineers -- some of the best in the world -- maintaining, patching, and securing the platform. While the third party ecosystem doesn't have as many options for doing X, the few options for doing X on .NET tend to be more well-rounded by the tighter community focus on a few, well-known libraries. Maybe some variation of an Apache Foundation like approach to curating a set of OSS NPM libraries and some mechanism of establishing trust would be beneficial to the NPM ecosystem? Just my take. [0]: https://arxiv.org/ftp/arxiv/papers/2110/2110.10246.pdf https://arxiv.org/ftp/arxiv/papers/2110/2110.10246.pdf