I don't follow your second sentence. Doesn't npm have the opposite problem of 'not invented here'? By adopting many external packages rather than developing in-house, npm projects tend to have large, complex dependency trees. It has long been the complaint that packages such as https://www.npmjs.com/package/is-windows create potential vulnerabilities and maintenance headaches, when writing the same piece of code directly is so simple.

Y'know just to talk a little bit

Some packages need to build native dependencies. sharp for example needs to build libvips on the system [0] to work

0: https://github.com/lovell/sharp/blob/main/install/build.js

I turn off running scripts on installation. So far, no inconveniences.

Bah, I think that these kind of vulnerabilities exist in any "packaging ecosystem" where the base language offer "ambient authorities"(any library can access your filesystem) which is .. all of them! AFAIK only research languages do not provide these ambient authorities :-(

I am not a JS dev, but had to interact with the ecosystem some. It became so bad I won't install anything without it being in a Docker or Podman container.

This x1000. This is the culmination of 15 years of frontend dev culture. Why does RedHat even have an NPM repo?

Seconded

the security of their packages should not depend on one laptop being compromised