Grunt is not the problem. It's using the npm ecosystem, the thousands of different codebases that I have little guarantee of constance over, that is the problem

Grunt is not the problem. It's using the npm ecosystem, the thousands of different codebases that I have little guarantee of constance over, that is the problem. Even using node.js alone (and no npm, no other libraries) would be extremely hard to audit, simply because of the huge code footprint of v8 alone. But at least I can download all the sources one time, audit it, and be certain every future build with the exact same versions would be safe. npm doesn't provide even that much guarantee.