> It's now rare for projects to properly audit their dependencies In the Python ecosystem, it is at least pretty easy to limit yourself to a handful of develop

> It's now rare for projects to properly audit their dependencies In the Python ecosystem, it is at least pretty easy to limit yourself to a handful of developers you trust (e.g. Django developers, Pallets developers, etc.). In the npm ecosystem however, for instance I just ran `npx create-react-app` and got a node_modules with 1044 subdirectories, a 11407-line yarn.lock, and "207 vulnerabilities found" from `yarn audit`. Well what can you possibly do.