Whilst this particular instance focuses on the JS ecosystem and NPM, realistically the general points apply much more widely. The number of commercial services

Whilst this particular instance focuses on the JS ecosystem and NPM, realistically the general points apply much more widely. The number of commercial services and pieces of software that are largely reliant on huge piles of OSS is significant. In contrast to that we're not really seeing those companies focus enough on the security of the OSS that they rely on. To provide two other well known instances, both Heartbleed and Shellshock sat as vulnerabilities in their respective OSS software for a large number of years. The packages were widely used by commercial software vendors, yet none of them discovered the issues...