> Are you really going to read through every single directory in node_modules/ to make sure you know exactly what you're running? Of course we are. Not manual

> Are you really going to read through every single directory in node_modules/ to make sure you know exactly what you're running? Of course we are. Not manually, of course, but we've got automated tools that generate a report of every dependency, including transitive dependencies, and its license and version, for all the platforms we use. We definitely keep an eye on these reports. "But it's haaaaarrrrd" isn't a great excuse for letting things get out of control. We're developers. Taking obnoxious labor-intensive manual processes and making them quick and easy is the entire reason why our profession exists in the first place. (Granted, the fact that a single import can bring in hundreds or even thousands of transitive dependencies to worry about is a big reason why I avoid the Node ecosystem like the plague. So there is that.)