I've asked myself the same a couple years ago, auditing yourself is impossible, it could be done by a third party but it'd be expensive if they do it for your p

I've asked myself the same a couple years ago, auditing yourself is impossible, it could be done by a third party but it'd be expensive if they do it for your particular use case. Another possibility, still by third parties, but auditing udates to open source code for the public to use, they'd have to use certificates to sign updates, we'd need a secure version of NPM which only contains audited packages. There would exist good audits and bad ones so you'd have to choose depending on level of quality, and you'd have to pay them too somehow. And there's a solution that would be a cheap way of finding the most obvious problems: AI-augmented audit, easy to automate, but could probably be fooled by some code changes.