Today I had to build and install an application using Crates. It recursively pulled 700 other packages and gave me a gut feeling comparable to testicular torsion. I don't care how paranoid the community is, it only takes one careless maintainer to node-ipc or left-pad an entire dependency tree.