Yes, vetting everything takes a LOT of time. Regardless of the language, package manager, etc. We (small shop) don't vet the code of all of our dependencies, s

Yes, vetting everything takes a LOT of time. Regardless of the language, package manager, etc. We (small shop) don't vet the code of all of our dependencies, since we simply don't have the manpower. But we do run nexus to have the guarantee of version pinning. So something that is fine today will be fine in 5 years.