> they're all pretty much designed to pull in a shitload of arbitrary unaudited and in some causes unauditable dependencies. No they're not. The dependency cir

> they're all pretty much designed to pull in a shitload of arbitrary unaudited and in some causes unauditable dependencies. No they're not. The dependency circle jerk went so far to prompt NPM to display all subsequent dependencies on each libraries page. The issue lies with the industry as a whole exploiting the work of OSS developers for their own gain and having the audacity to complain when these volunteers won't additionally do a security audit for free.