Re 2: Perhaps the auditor isn't referring to open source products being shutdown, but rather package info being pulled abruptly making the package inaccessible

Re 2: Perhaps the auditor isn't referring to open source products being shutdown, but rather package info being pulled abruptly making the package inaccessible for some period of time. Particularly I'm thinking of the whole npm left-pad fiasco (http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm, https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be67c https://medium.com/@azerbike/i-ve-just-liberated-my-modules-...).