But here's the catch. If you do that in a lot of places, you'll have a lot of ex... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

kbrkbr 10 months ago | parent | context | favorite | on: Malicious versions of Nx and some supporting plugi...

But here's the catch. If you do that in a lot of places, you'll have a lot of extra code to manage.

So your suggested approach does not seem to scale well.

lxgr 10 months ago [–]

There's obviously a tradeoff there.

At some level of complexity it probably makes sense to import (and pin to a specific version by hash) a dependency, but at least in the JavaScript ecosystem, that level seems to be "one expression of three tokens" (https://www.npmjs.com/package/is-even).

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact