Comment by qup

My God, the list of npm dependencies some projects I've worked on had.

Endless.

Anyway, it could have been me. I don't inspect vim plugins before install, generally.

Security is hard. Even if you're an expert, it's a lot of work.