#npm’s culture presents a major problem for global software #security. It’s grossly irresponsible to let dependency trees grow to thousands of dependencies, from vendors you may have never heard of and likely have not critically evaluated, to solve trivial tasks which could have been done from scratch in mere seconds, or, if properly considered, might not even be needed in the first place.

https://news.ycombinator.com/item?id=29240952

（前面转发没有评论区，下面两个按钮真是多余，正好摘抄一下。）