I would say keep an eye on dev dependencies which are a part of the build process. Malicious code there could easily append malicious code to the production bui

I would say keep an eye on dev dependencies which are a part of the build process. Malicious code there could easily append malicious code to the production build, even if you have a deployment server setup. This is just as dangerous as a malicious production dependency.