Hacker News Reader

What do you do for security updates? There are a lot of them for NPM modules. Seems GitHub manages the database for those now:

I swear 99% of them are prototype pollution or regex DOS that don't apply to how I'm using the dependency.

See, now I can only assume you are playing with our emotions. You got the forehead vein going at first though so I'll give you that.

What about the 1% that delete data or allow for code execution?

Snapshot VM, npm install

And how do you know that is safe and hasn't exfiltrated all your data or used a VM escape exploit.