I'm so sick of people saying this. If you use js for any non-tiny project, you'll have a bunch of packages. Due to how modules work in js, you'll have many, many sub dependencies.

Nobody has time to review every package they'll use, especially when not all sub dependencies have fully pinned versions.

If you have time to review every package, every time it updates, you might as well just write it yourself.

Yes, this is a problem, no reviewing every dependency is not the damn solution