Comment by batshit_beaver
3 hours ago
When people install npm packages, they typically only install ones the community trusts. These packages have clear APIs, open source, good docs, test coverage, security checks, and, importantly, usually no undocumented side effects.
Engineers introduce these packages into their own projects that have far fewer of the above guarantees than OSS, are built under pressure from deadlines, and have a constantly churning set of maintainers.
I think from the perspective of a business its own code does call for greater scrutiny than its dependencies.
> When people install npm packages, they typically only install ones the community trusts.
This is wishful thinking. Devs add in dependencies to do mundane stuff all the time, regardless of provenance.
As others pointed out, the default install for many modern web dev frameworks includes hundreds of dependencies.