I think it's been said elsewhere, this is true but the frequency and severity is orders of magnitude less with the languages with good standard libraries. When

I think it's been said elsewhere, this is true but the frequency and severity is orders of magnitude less with the languages with good standard libraries. When the entire ecosystem depends on left pad I think you have a problem. When the entire ecosystem depends on express it is less of an issue because more eyes are invested in auditing it and changes are more widely reviewed. You think a nefarious leftpad function would make it's way into express? It could, but it is way less likely. Updating the dependency to a newer version of left pad isn't going to raise an eyebrow. And that is the issue.