And then the vulnerable code will just move to shell execs in the main library that fire the next time you include the library in your project.
If you do not have time to review a library, then do not use it.
If you do not have time to review a library, then do not use it.
On the other hand, yes, an attack at code level, or a legit bug wouldn't be prevented.
Nobody has time to review every package they'll use, especially when not all sub dependencies have fully pinned versions.
If you have time to review every package, every time it updates, you might as well just write it yourself.
Yes, this is a problem, no reviewing every dependency is not the damn solution
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
And then hardware compromises…
I don't mean install anything. I mean, it's not a problem particular to the JS ecosystem.
"just give up" is not a valid strategy.
Also now as someone that runs a security consulting firm, we absolutely have clients that review 100% of dependencies even when it is expensive.
Both are valid options.
Normalized negligence is still negligence.