3 ms·

You're right, of course, but there's little practical difference from doing `npm install` unless you're actually auditing the supply chain. It just automates a

You're right, of course, but there's little practical difference from doing `npm install` unless you're actually auditing the supply chain. It just automates a step.

christophilus 2y ago
The difference is that you have a single file to audit with npm. With Deno, any file in your codebase might pull in a dependency.
- iforgot22 2y ago
  That assumes someone is actually auditing the npm deps.
  - feross 2y ago
    It’s trivial to audit your dependencies with https://socket.dev https://socket.dev Disclosure: I’m the founder.
    - iforgot22 2y ago
      Despite the ease of auditing services, there are notoriously a lot of devs using unaudited deps. Maybe they don't even think about it, unfortunately.
- flohofwoe 2y ago
  Which isn't really a problem for simple one-file 'shell scripts'. For bigger projects, Deno already suggested to maintain all external imports in a central file.