Hacker News Reader

extremely lightweight https://www.npmjs.com/package/iso20022.js?activeTab=dependen...

Looks like twelve libraries total.

Visualized: https://npmgraph.js.org/?q=iso20022.js

Why NPM in particular? Is there any package manager where you don't have to audit your dependencies?

Yes, any repository that uses maintainers and doesn't let anyone upload random stuff to it, like Debian stable. Package maintainers are the missing piece.

NPM is particularly nasty because they've solved the issue of transitive dependencies having mismatched versions. This removes one of the biggest immediate pain points caused by having very large dependency graphs so you only feel the pain later on. Because of that you get this emergent behavior of unusually large dependency graphs in a lot of NPM packages.

That’s what fintech is, one large dependency tree

With internal infosec, secinfra teams, compliance, and serious business contracts.

With 500 MB of unversioned, arbitrary JavaScript?