NPM doesn't change anything here. the same issue would exist if you could only vendor dependencies.
Are you sure you understand the issue?
Are you sure you understand the issue?
Edit: Answer to “always_good”:
If a toddler shoots himself with a handgun, we can say that his mistake was pulling the trigger.
While technically correct, it’s not addressing the real issue, that is, how did the toddler get hold of the gun in the first place?
Passing user input into arbitrary shell commands is the mistake.
Good examples of amateur criticism that plagues our field, though.
Stop the nonsense. Seriously. Stop.