Pulling in lots of dependencies creates this kind of risk regardless of the ecosystem. That being said in the JS/NPM world you tend to have a LOT more dependencies (especially indirect ones) than other languages. I saw someone do a cursory analysis and JS/Node projects tend to have 5x the number rust or ruby projects.
replyThis is really a cultural problem not a technical one.
It's funny how left-pad was always brought up as a JS supply chain vuln when that wasn't even malware
replyIf it weren't a registry it would be ./configure scripts and makefiles. The issue is that sandboxing technology is kinda shit (especially x-plat) and languages don't build it in by default.
replydeleted
reply[flagged]
reply> Just wondering, whenever things go wrong with Rust - why do you all (Rust devs) point the finger at JavaScript?
replyI know it is almost a sport to point fingers at the "evil rust evangelists" on HN at this point, but a quick look at the fnoef's comment history would show you that they are not a rust person.
Your account, on the other hand, is a sock puppet created specifically to bitch about rust. Pot, meet kettle?
[flagged]
replyYou're literally replying to someone saying npm is unfairly called out.
replyRust developers aren't the ones who have problems with it. Otherwise they likely wouldn't be using Rust in the first place. I don't see anyone saying JavaScript is worse about it either, more that they're the same.
Why are you getting so defensive about it?