I think it’s widely known that the JS dev community relies too much on dependencies, especially through npm packages, and that it’s really hard to avoid this problem (I use as few packages as possible, but each dependency has its own hundreds of dependencies which also have hundreds more…).
But I think I never stopped to think of how easy it is to publish a package there. Which also means, it’s too easy to publish a malicious or compromised package, that gets downloaded and executed on our computers with no proper vetting. Scary.
