Hacker News
points by user43928 15 hours ago | 0 comments
Then you probably haven't worked much with JS.

The Jest test runner alone has 250 dependencies in its latest version, and v25 had over 500.

[–] viklove 6 hours ago
Not sure how you operate, but I've never worked on any project in my 10+ years as a professionally employed JS dev where we've shipped Jest in our release.

I don't audit all the code I run (I don't think anyone does), but I do audit all the code I _release_. What's actually important to you?

[–] ang_cire 5 hours ago
You don't have to ship a dependency for it to be a vulnerability; the shai hulud worm was attacking dev machines and cicd environments to steal credentials. The deps you run are absolutely just as critical.