If dependencies are considered a risk without any indication of anything wrong with any particular ones, npm should be the biggest footgun ever and probably rem

If dependencies are considered a risk without any indication of anything wrong with any particular ones, npm should be the biggest footgun ever and probably removed from the repositories altogether! $ apt-cache depends npm | wc -l 151 Over a hundred separate projects are being pulled in for this one command. If only this were a niche project nobody ever uses for anything important. > (I'd rather isolate the password manager so it can't access the network, etc.) That won't help either: https://xkcd.com/1200/ https://xkcd.com/1200/ Any program can alias the Keepass command or menu entry. It takes a vulnerability in any of, eh, *checks dpkg -l | wc -l*, over 4000 packages to supply-chain-attack my desktop setup