3 ms·

What's your main concern, the npm modules?

• gardnr 2y ago
  If you don't `npm config set ignore-scripts true` then you are basically executing random unknown code every time you do an `npm install`. Modules can change hands and become malicious, which is much more plausible when there are thousands of sub-dependencies in a pretty standard modern web app.
• smokel 2y ago
  My main concern is the impossibility of finding trust in library dependencies. A typical React app has somewhere over 2,000 packages from almost as many different sources. It is impossible to check the reputability of each contributor. I'm aware of things like "npm audit", but with the amount of false positives that spews out, it seems one just has to trust the entire ecosystem. My intuition keeps telling me that this is a disaster waiting to happen, and I'm trying to understand how this can be so pervasive.
  • deleted 2y ago
    [deleted]