If you're developing something dealing with sensitive info (like, say, something processing cryptocurrencies) and you can't audit your codebase then you shouldn

If you're developing something dealing with sensitive info (like, say, something processing cryptocurrencies) and you can't audit your codebase then you shouldn't be doing it in the first place frankly. Of course in this case this is made worse by the fact that Javascript is so under-featured by default that you have to pull a ridiculous amount of dependencies to do anything which makes it a lot harder to audit everything. Besides since the language is so dynamic it's easy to write a very small, very powerful "shellcode" that can hook itself up anywhere in the software stack.