Hacker News Reader

And pulling ~67 dev dependencies just to be able to transpile TS to JS? No thanks.

https://www.npmjs.com/package/typescript

This comment shows perfectly that people has no clue what they're talking about, these dev dependencies will never be pulled into your project, they're just for typescript's own development.

> these dev dependencies will never be pulled into your project,

Please, don't ruin "JS bad" thread with facts. It's rude.

Do these dependencies actually matter when you deploy or are they just used for the actual compiling?

If they are required for the compile and someone manages to get something malicious into them, they can certainly affect the produced/deployed artifact.

See Ken Thompson, Reflections on Trusting Trust, 1984 https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Reply on news.ycombinator.com