Hacker News Reader

> and which directly pulls in any dependency and exploit

Fix't it for ya.

You can pin versions. If you aren't, you have the same issue with regular npm.

> You can pin versions.

You can, but you won't. Let's be real for a second now - the only reason you use this feature is because you can't be bothered to use a real package manager that pins versions.

The reason is if you have a small script as a single js file and don't want a separate package file and build step. The given example was ^5, same effort as =5. I guess you can also import different versions in different files?

No, version pinning is a lockfile that has verified hashes of git revisions.

Reply on news.ycombinator.com