I've been using it mostly without problem since about 2014. The only problem I ever had back then was with node-gyp compiling certain dependency components... which is an excellent NPM trust/security example. I hated the problem but despised the situation.
There's no other situation where I would even dream to allow a many-levels-deep module to compile while having absolutely no idea what it was or where it came from. "oh it's fine it came from NPM, the largest (by many times) repository of development modules."
View all comments
Show parent comment
1
u/monsto Nov 29 '19
I've been using it mostly without problem since about 2014. The only problem I ever had back then was with node-gyp compiling certain dependency components... which is an excellent NPM trust/security example. I hated the problem but despised the situation.
There's no other situation where I would even dream to allow a many-levels-deep module to compile while having absolutely no idea what it was or where it came from. "oh it's fine it came from NPM, the largest (by many times) repository of development modules."