Hacker News Reader

It's not just the complexity. You're also vulnerable to supply chain attacks via NPM. It's also performance as you don't need the entire javascript runtime just for a CLI.

View on HN

Pretty much every modern language with a package repository is vulnerable to supply chain attacks.

Are there any languages doing something unique or are especially resilient in this respect?

You can get a binary compiled by the author or a trusted source and none of the dependencies can change out from under you. This isn't possible with an interpreted language where the dependencies are resolved (often from dubious places like npm) at install and update time.

You can write a CLI in typescript and bundle it into a a single JS file. In fact (without looking) I’m sure that’s what Cloudflare is doing here because it’s standard practice.

> It's not just the complexity. You're also vulnerable to supply chain attacks via NPM.

Oh you mean like the attacks that occur in Rust's cargo?

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on...

Reply on news.ycombinator.com