Hacker News
points by viklove 6 hours ago | 0 comments
Not sure how you operate, but I've never worked on any project in my 10+ years as a professionally employed JS dev where we've shipped Jest in our release.

I don't audit all the code I run (I don't think anyone does), but I do audit all the code I _release_. What's actually important to you?

[–] ang_cire 5 hours ago
You don't have to ship a dependency for it to be a vulnerability; the shai hulud worm was attacking dev machines and cicd environments to steal credentials. The deps you run are absolutely just as critical.
Hacker News