Standing on other people’s code.
Packages save you from rebuilding common things. Each one is also code you didn't write, from people you don't know, that you now depend on.
Four Terms
Package
A ready-made piece of code you install.
Version
2.4.1 = major . minor . patch. Major changes can break things.
Lock file
package-lock.json: the exact versions. Commit it.
Update
Security fixes arrive as updates. Old means risky.
Before adding one, ask
Do we actually need it?
Is it widely used?
Updated in the last year?
Could a few lines do the job?
Source: Semantic Versioning 2.0.0 ↗
Every package is a promise you now have to keep.