That actually is a really good point about packages on NPM, or rather the culture of a 'package for everything.'. All it would take is somebody to lose their gi

That actually is a really good point about packages on NPM, or rather the culture of a 'package for everything.'. All it would take is somebody to lose their github account or go rogue, for one popular package that requires their package to also be compromised, and then hundreds to thousands of sites are silently vulnerable. Seriously. A standard ES6 JS project will run you to actual hundreds of packages. Thats a huge attack surface.