Hacker News Reader

Great. By compromising one package you can access their bank account...

Same thing as compromising one of these packages loaded from a CDN...

If someone loads a bad JS library, it doesn't matter where it came from.