django-money VS event-stream

I know this is not point of the article but:

> The PR was bigger than what I felt I could sensibly review and, in honesty, my desire to go through the hours of work I could tell this would take for a project I no longer used was not stellar.

The PR: https://github.com/django-money/django-money/pull/2/files?di...

Do others share this sentiment?

This doesn't look like a particularly big PR to me, judging solely by the amount of code changed and the nature of the changes at first glance.

Are most of your PRs at work tiny, couple lines of code at most? Am I sloppy for not even consider reviewing this for "hours"? Are all code bases I have worked on sloppy because features often require changing more code than this?

Currently I'm storing prices as django-money field but now I'm questioning the benefits of it and considering just storing prices in USD cents by default since the payment providers are handling currency exchanges anyway, what's your take on it?

Da du ja Django benutzt: Benutz auf deinem Model DecimalField oder Django Money wenn du es etwas high-leveliger haben willst.

oh, thank you, I have bookmarked this, page, will come in handy later, thank you!

Another possible outcome of "I gave commit rights to someone I didn't know": https://github.com/dominictarr/event-stream/issues/116

Whole npm ecosystem is so fragile.

Remember event-stream[1]? Did we learned something from that? Yes, we might. So was it improved? Never. People are still installing 'new' colors package and wondering why its texts are broken.

What if he uploaded malicious code rather than just just gibberish?

[1]: https://github.com/dominictarr/event-stream/issues/116

foo-bar version 1.0 depends on bada-boom 1.0 which depends on bada-bing 1.0. Now you update to foo-bar 1.1 because of some critical update, which in itself now depends on bada-boom 2.0 and bada-bing 2.0. But unbeknownst to you and the author of foo-bar, the bada-boom and bada-bing project was taken over by another maintainer who made an update, but also added some trojan horse code to specifically attack certain users, which was obfuscated and remained undetected. Which has happened before - not just browser extensions are affected by malicious attackers taking over useful projects.