Node.js packages don't deserve trust
TL;DR: There&#x27;s nothing fundamentally less worthy of trust about node&#x27;s supply chain than any other popular mainstream language ecosystem. They&#x27;ve all got some badness.<p>---<p>Here&#x27;s a trope I&#x27;m tired of:<p>Take X general problem that affects a wide range of systems, attribute it to one narrow system Y. Usually because that system Y&#x27;s general accessibility and success leads to a higher number of high profile incidents related to problem X.<p>One of the practical outcomes of this trope is people trying to solve this problem in narrow, ecosystem-specific, non-portable ways.