I wonder if there are projects out there for an option 4: 4) Use an OSS dependency checker tool that reports the risk in your dependency tree 4a) Dependency t

I wonder if there are projects out there for an option 4: 4) Use an OSS dependency checker tool that reports the risk in your dependency tree 4a) Dependency tool uses a crowdsourced database of audit/review metrics A typical NodeJS project has potentially 1,000's of (transitive) dependencies. Many well-established projects use dependencies versioned e.g. 0.0.1 etc. I guess there are hundreds of similarly unmaintained packages among these. Lacking 4) a small-time developer working on a side-project only has option 1) (or option 0 - Take the risk) as a feasible way to go.