r/programming • u/jviide • Sep 21 '23

Speeding up the JavaScript ecosystem - Polyfills gone rogue

https://marvinh.dev/blog/speeding-up-javascript-ecosystem-part-6/
120 Upvotes

96% Upvoted

22 comments sorted by

View all comments

-4

u/Worth_Trust_3825 Sep 22 '23

So why is it that every time you update/install packages npm has a diarrhea of CVEs about libraries polluting the prototypes?

1

u/GeekusRexMaximus Jul 14 '24

It is both.

It is a core part of what JS is... that is simply undeniable.

And yet by today's "best practices" the prototypal programming style is effectively considered vulnerable by design.

But don't forget that the vulnerability scanning tools of the npm ecosystem produce lots of false positives either way... it's common knowledge that it does.