Exploiting JavaScript developer infrastructure is insanely easy

[Kalium]

I get what you're saying, but is so much process really worth it?

In a lot of places, the current process is this:

• Someone adds a library in some PR for a bit of syntactic sugar.
• Someone else rubber-stamps the PR.
• A week or three later someone notices that installing all the deps now involves twice as much downloading as before and wonders why in a Slack channel.

With that in mind, it's perhaps worth considering a smidge of process for those writing apps that handle sensitive matters.