Installing the budibase server from npm pulls in over a thousand transitive dependencies. The npm install command reports that there are 39 known vulnerabilities in budibase's dependencies, including 9 that are classed "high" and 3 that are "critical" severity. The dependency graph includes a lot of crap, like packages containing trivial single-line functions like "is-object" and "is-stream". That's a very large atta…
I've never understood introducing this kind of dependencies. Depending on the legal conditions (usually favorable) one can simply extract the code they need from those packages and put it into some consolidated lib on their own.