The interesting part is how professional the packages are handled. For example in JavaScript there a thousand of authors with very different understanding of their "responsibility". Some do not even provide a license (do not even care to put a "WTFPL" or "Unlicense" on it) and do not read bugs. Others, have a emergency response team and publish CVE records. The less packages I have, the better I can select them and monitor them.
Java/.NET/Python ecosystems tend to be more professional with this regards. JavaScript catches up but is not completely there yet (you can see this with the amount of repositories who add licenses in 2016/2017 timeframe, years after creation).
Hence, same amount of code, much more work (it is a magnitude).
Java/.NET/Python ecosystems tend to be more professional with this regards. JavaScript catches up but is not completely there yet (you can see this with the amount of repositories who add licenses in 2016/2017 timeframe, years after creation).
Hence, same amount of code, much more work (it is a magnitude).