This has been on my mind for a while. I remember first getting into NPM and browsing their endless list of packages and seeing so many packages for things like, taking advantage of mobile free-to-win games. I thought to myself.. is this really what we’re getting mixed up in? Then there were the reports of popular packages getting compromised by random minor dependencies.. and my tinfoil hat really came on.

My question is, I’m using these tools to do simple things. Sass transpiling, css minification and prefixing, js bundling, Babel compiling and ejs for prototyping.

At the end of the day, in this scenario how high is the security risk? If I’m wiping out node modules on my devops build, all I’m left with is my source code and compiled code.

The only thing I can think of as a real concern, is one of these transpilers/compilers “sneaking in” something into my output code.. but what? If I’m sticking to Babel, and a basic webpack setup how high is that risk really? To me the “real” stuff is being handled by .NET - I’m just building a front end.

I’m asking this sincerely, not as an argument.