[runningmike]

Popularity is never a metric for security or quality….Always verify.

[user34283]

Verify what? I certainly don't have the capacity to thoroughly review my every dependency's source code in order to detect potentially hidden malware.

In this case more realistic advice would probably be to either rely on a more popular package to benefit from swarm intelligence, or creating your own implementation.

[bdangubic]

also scrutinize every dependency you introduce. I have seen sooooo many dependencies over the years where a library was brought in for one or two things which you can write yourself in 5 minutes (e.g. commons-lang to use null-safe string compare or contains only)

[criddell]

Verify? Verify what?

[sneak]

Over a certain popularity it is. 56k downloads is nowhere near the threshold.

[k8sToGo]

But... GitHub stars!