I know of course. But you still need to audit them before. And then on every npm update you do. It can be a full time job. But even then there’s no guarantee yo

I know of course. But you still need to audit them before. And then on every npm update you do. It can be a full time job. But even then there’s no guarantee you’ll slip and miss. I can definitely see a potential targeted attack. Since you could reverse the 1P bundle and see what packages it uses and then try to insert some malicious code. And then gain access to millions of 1P vaults.