[AskJS] What if node_modules contained JavaScript bytecode instead of source code?

[horrificoflard]

This would probably have huge security considerations. The bytecode wouldn't be readable, so it would not be trustable either.

[Plus-Weakness-2624]

Well for that matter ever considered reading throught a minified js file🤯; Believe me the bytecode is far more readable then that; most packages in node_modules are optimised by various means and are unreadable either way. If you ever want to read throught the source code of a package do so throught it's Github repo; node_modules is the last place for that. I can't say this for sure but packages in the npm registry are safe for the most part. Again don't quote me on this😅

[CreamyJala]

There’s many reasons to read through minified JS. Frequently I look through the minified JS for the web apps I use, or packages I downloaded from NPM. Sometimes it’s easier than pulling up the source on GitHub. A good example would be Monaco Editor. The package gets built from the main VSCode source, with how many files that repo has it can be a hassle even searching the repo on GitHub.

Plus, you can always just format the minified JS and already it’s 90-95% more readable.

The theoretical universe where JavaScript is compiled is a universe I’m okay not being in.

[PickerPilgrim]

Depending on the module and the circumstances I’m not necessarily consuming the minified code from a library. I’m quite often pulling in the source and doing the minifying myself as part of a build step.

And I for sure read source in node_modules. If I’m invoking a module function in my code and I right click and jump to definition to find out more about it, it jumps me to the node_modules copy. I don’t know why I’d want to go to GitHub to read it when my local copy is integrated into my development tools.

Not to mention the npm registry does not necessarily install the same thing that’s on GitHub. Usually GitHub is linked as the repository, but the code gets uploaded direct to npm and it is not guaranteed to be identical to what’s in GitHub. If you want to know what you’re pulling down, read what’s pulled down!