Earlier quoted context omitted.
> If you already had left pad cached then you were not affected by its disappearance. The evidence of course is that when you say "left pad" no one knows what you're referring to because nothing bad ever happened. > If a package needs an install script to be used, to compile some native code for example, you still need to run the install script before you can use the package. This already sounds like a giant red fuck…
> There is 100% benefit in running that shit in a development environment. Most of the recent supply chain attacks specifically target stealing secrets from development environments. > But hey thanks for proving me right about the unhinged complaints. I'm sorry if I'm upsetting you, but I am not complaining or trying to provoke you. "Just check in the dependencies and review them" is not a revolutionary idea. It make…
If your secrets in a dev environment can actually do any damage if leaked, you're doing something very fucking wrong.
> React's last minor version bump included 100 files and ~5k changes.
So you're choosing over engineered dependencies and then complaining they're too big.
Somehow I think the problem, as usual, started with the meat sack on the chair.