[kataklasm]

But that is the kind of convenience and ease of use that brings us another npm malware incident every other month at this point.

[juliangmp]

This is a real problem but I wouldn't blame the existence of good tooling on it. Sure you don't have this issue with C or C++, but thats because adding even a single dependency to a C or C++ project sucks, the tooling sucks.

I wholly blame developers who are too eager to just pull new dependencies in when they could've just written 7 lines themselves.

[jandrese]

I remember hearing a few years ago about how developers considered every line of code the wrote as a failing and talked about how modern development was just gluing otherwise maintained modules together to avoid having to maintain their own project. I thought this sounded insane and I still do.

[r_lee]

And in a way I think AI can help here, where instead you get just the snippet vs having to add that dep that then becomes a long-term security liability

[krior]

On the other hand you don't have developers handrolling their own shitty versions of common things like hashmaps or json-serializers, just because the dependencies are to hard to integrate.