Right — the only way to really identify malicious packages is a line by line audit... All the way down the dependency chain. On top of that, does a typical org

Right — the only way to really identify malicious packages is a line by line audit... All the way down the dependency chain. On top of that, does a typical org using these packages have developers who can conduct these audits and identify obvious back doors? What about less obvious bug doors?