[ktusznio]

What about services like npm that distribute code? Are these analogous or do they have additional security in place?

[jacquesm]

Isn't that server side?

[ktusznio]

Yes, but the same attack could happen if an attacker gains control of an npm module. Users without tight control over their modules could unwittingly pull in malicious code.

[Zikes]

With dependency resolution and node_modules folders dozens of levels deep, it's pretty difficult to verify untrusted code hasn't been injected somewhere.

[hexasquid]

Not really. NPM is also used with a tool called browserify to enable frontend web developers to use NPM modules in the browser.