You’re good to keep your skepticism. If you trust them, the ones creating the tutorial to have vetted to a degree, or that a very popular package like that is vetted to a reasonable degree, you’ll just go ahead with it. (Like most people do without questioning it.)

You’ll need considerable experience and insight to do good, reasonable risk assessment. Without that, you can either trust and hope in others, or skip the ecosystem and look for alternative technologies.

It’s also worth noting that your potential impact is considerable lower if you’re only doing local test and development work, not publishing or publicly serving anything. I’m not personally familiar if or to what degree running arbitrary local commands has been limited in the npm ecosystem by now.

You shouldn’t eat candy given to you by strangers. If you’re in a large group and someone knows the candy, maybe. Code is food for your computer. Be wary. Our large Open Source group of friends has learned about many kinds of candy and shouts loudly when some in the group becomes ill. You don’t want to become ill. Some risk exists, but with a large group it is generally ok. Don’t install packages as root, don’t install what you don’t need.

I run my frontend builds through Docker (also during development). By isolating access to the host system to the files/folders necessary for development I’ve shielded off the majority of current realistic attacks I’ve seen as NPM based exploits. I’m certain the approach can be replicated for other frameworks, but we use Ember and docker-ember. I doubt it runs as smoothly on a non-Linux OS.

Finding a Webpack replacement that doesn’t use NPM at all is going to be hard, but there are certainly alternatives that don’t require the 1000+ NPM dependencies required to use Webpack.

Some alternatives you can consider are Rsbuild and Farm. Part of the reason they use so much fewer NPM dependencies is because they’re written in Rust, so they’ll have Cargo dependencies instead, but you shouldn’t notice anything of that. Of course if you want to audit everything it’s not that much easier, but at least the Cargo ecosystem seems to have avoided quite some of the mistakes that NPM made. But yes, in the end it still comes down to the extent that you trust your dependencies.

Yeah don’t worry about it too much. Ensure you have the correct name when installing your library but that’s about all you can do personally.

Any other solution will have some security flaws. NPM has a few more than it should but essentially the entire web is built around it. Sorry man, you don’t have any other choices.

How to use it properly? Any npm tutorial will show you quickly. Always check you’ve got the right thing, always check the library is large enough that if something goes wrong it’ll be noticed, and know there’s no way to be completely safe without never using libraries.

If you’re learning the web though there’s no way to avoid npm.

As an alternative to Webpack, I like esbuild. Not as powerful, but way simpler to use, and handles maybe 85% of common use cases.