With NPM as an example to fully know every dependency is a highly time-intensive and complicated task due to following: * you can't be sure code in package is

With NPM as an example to fully know every dependency is a highly time-intensive and complicated task due to following: * you can't be sure code in package is same you see on github as npm doesn't do signatures * code already in node_modules is usually minified and obfuscated So only real way to be sure is to make own repository, copy every dependency, check code, build own packages and only use packages from your repo. Repeat process when versions are updated. So to answer your question, yes, 99% of apps, they don't know.