Comment Re:Remotely downloaded code (Score 1) 12
What, exactly, is the point or purpose of including code in your program that is downloaded from a third-party website every time you execute the program?
No, npm is literally the opposite of that.
If you want to include a function or subroutine or library in your program, why wouldn't you just download it and use that?
I run Drupal and it uses composer, which does basically the same thing. But then I want some javascript libraries that you can't get through composer repos itself, you need to get them from npm. So every time there's one of these npm exploit stories I say oh shit, some more shit I need to read. Luckily I'm only pulling in literally two packages from there. But I don't need to do this, I only do it specifically for the purpose of not having my site refer to some other site for those javascript libraries. That way, someone else changing their library doesn't automatically screw up my site, or more plausibly since I am not running any javascript on the server side, start back dooring other people who visit there. So npm is exactly the kind of thing you think people should be using, except with less oversight which is why we keep hearing about loads of compromised packages.