> But considering the amount of collaboration effort it took to build this (fb said they collaborated with multiple companies in different timezones), wouldn't it be better to spend a little more time understanding npm's codebase and get it patched ?
Better for you? You know that open source work is free labor, right? Why should they prefer to spend weeks trying to understand undocumented, opaque and "clever" code (much of which has never been refactored) when they can start from scratch with a codebase of their own design?
What I'm asking is, what is the value to them? Or to you (assuming you ever do open source)? Unless you are getting paid for your OS work, you're under no obligation to do things any way other than what works for you.
