Sometimes those commonly used packages end up being whatever dumb algorithm the author came up with, and nobody spends the time to verify if the package is worth it's popularity.
Doubt that. Popularity comes with heaps of PRs, some useful some less.
If anyone used a JSON parser that took 4 minutes to parse a file you bet the author would know by the time the 100th user comes around.
I had a tiny barely-used detection library that didn’t detect it correctly in a new Edge browser update. Someone complained about it within the first month. The library has 20 stars and Edge has 500 users.
Edit: Correction, it was 9 days after the browser release.
