This article is four years old but still relevant: https://overreacted.io/npm-audit-broken-by-design/ https://overreacted.io/npm-audit-broken-by-design/ The va

This article is four years old but still relevant: https://overreacted.io/npm-audit-broken-by-design/ https://overreacted.io/npm-audit-broken-by-design/ The vast majority of "compromised packages" are just dev dependencies that have a slow regexp.