You may not think so, but I know of equally reputable firms that have overlooked things as blatant as software that allows third parties to pipe scripts without

You may not think so, but I know of equally reputable firms that have overlooked things as blatant as software that allows third parties to pipe scripts without any notification to the user. Look at the recent NPM discussion for example, and that isn't even the one I am referencing. So, yes.. they may be a "legit" outfit but that doesn't prevent them from ignoring obvious security issues.