I agree with you there, however reality is that you may have one of these packages in your build, on your system, just through merit of using something else in

I agree with you there, however reality is that you may have one of these packages in your build, on your system, just through merit of using something else in the js ecosystem. We are never going to have a vetted set of dependencies. It will forever remain a mess as long as the platform and ecosystem exist. At best we can be reactive and kick bad actors out of the picture.