[mattigames]

Well, is exactly the same for any npm package or any python package as do many other languages, a lot -if not all- bad security comes from 3rd party plugins.

[jermaustin1]

I'm perfectly capable of bad security on my apps without the use of 3rd party plugins, thank you very much!

[tyingq]

Technically the same perhaps. But the actual history is pretty different. WordPress plugins are notorious for RCE type vulnerabilities.

[jermaustin1]

I wrote one during my early years, in fact [1]!

1: https://jeremyaboyd.micro.blog/2016/11/20/that-time-i.html