Thanks for that explanation. That makes sense.

I guess I should also mention IHP.

As far as npm and Purescript goes: I don’t interact with npm when I use it. I use nix and nixpkgs to build it which pulls packages from a predefined, fixed package set inside of Pursuit (Purescript’s package manager that feels a whole lot like Stackage). I suppose if I wanted to use it in the real world, I’d probably have to expose myself to some npm. But, from my cursory understanding and experience, it is probably less tainted by the safety issues in the npm than straight up JavaScript. Packages in Pursuit (particularly the ones exposed in the standard package set I use) tend to be super high quality code like the modules you’d find in GHC.