This is what `npm audit` is for. It's not perfect obviously, but it should prevent the worst. Besides, my guess is that the vast majority of developers do not

This is what `npm audit` is for. It's not perfect obviously, but it should prevent the worst. Besides, my guess is that the vast majority of developers do not verify their dependencies in the first place. No matter if it's number is 5 or 5000.