The recent spate of supply-chain attacks in the JS ecosystem (and others, but NPM is by far the worst offender) has me reconsidering my approach to 3rd-party dependencies.
First of all, less is good. I probably don't always need that whole library, I just need a piece of it. Can I copy it into my project myself? Can I write what I need myself?
Second, auditing dependencies is important. Do I expect myself to read every line of code in every package I import? No. But I do expect myself to give each dependency, and especially each one that ships with the production build, more careful thought.
MichaelJ
npub1wq…cqsyn
2026-05-18 17:28:53 UTC
Author Public Key
npub1wqfzz2p880wq0tumuae9lfwyhs8uz35xd0kr34zrvrwyh3kvrzuskcqsynPublished at
2026-05-18 17:28:53 UTCEvent JSON
{
"id": "04ad1da11e6cb539eabeed4ad9b9c21e4cd7f62b6f3aff94368794e3cfe1705f",
"pubkey": "70122128273bdc07af9be7725fa5c4bc0fc146866bec38d44360dc4bc6cc18b9",
"created_at": 1779125333,
"kind": 1,
"tags": [
[
"client",
"imwald"
]
],
"content": "The recent spate of supply-chain attacks in the JS ecosystem (and others, but NPM is by far the worst offender) has me reconsidering my approach to 3rd-party dependencies.\n\nFirst of all, less is good. I probably don't always need that whole library, I just need a piece of it. Can I copy it into my project myself? Can I write what I need myself?\n\nSecond, auditing dependencies is important. Do I expect myself to read every line of code in every package I import? No. But I do expect myself to give each dependency, and especially each one that ships with the production build, more careful thought.",
"sig": "66c60e181d062f3015342b197752e542230ae80e22badf319d812ed9d49085bdbcb463740f3097c3e0f7d3bf5319d353d893cc0580b481bf7fe5f3790d5c656f"
}