It is however safe to say that there are a lot more eyes on those 400 npm packages than there are on the Windows source code. Moreover with the spread of bug b

It is however safe to say that there are a lot more eyes on those 400 npm packages than there are on the Windows source code. Moreover with the spread of bug bounty programs I would expect that the likelihood of security bugs in widely used open source software to be further reduced. It should be a lot easier for a bounty hunter to find bugs in open source packages that are used by some target companies than to find them without access to the source code.