Hacker News

points by hdjrudni 4 days ago | 0 comments

Sure, but JS has a myriad of choices too and yet we mostly agree on node_modules, package.json and npm (the repo). Big companies or weirdos are free to swap any of those with something else if they want but the little guys have something standardish if they don't want to inflict too much pain upon themselves.

[–] rerdavies 3 days ago

Personally, I find node_modules and package.json completely terrifying. A solution teetering on the brink of a catastrophic implosion. I have a moderate sized project that pulls in several hundred dependencies and dependencies of dependencies, any one of which could contain a supply chain attack when I upgrade my dependencies. Which I must do. Upgrading is not an option; but it's only a matter of time before I get hit.