It's never as simple as finding exploits in code review though. Trusted accounts are compromised or the credentials to the package manager are compromised or th

It's never as simple as finding exploits in code review though. Trusted accounts are compromised or the credentials to the package manager are compromised or there is some other supply chain attack. Larger packages tend to have a lot more community and governance around them than your typical JS-style function-as-a-dependency left-pad affair, so maybe they're safer if computer accounts are gatekeeping the published artifacts rather than having individuals embed their personal keys or tokens into the publishing pipeline. I've had this debate before and, as far as dependencies go, sometimes you have to rip the bandaid off and audit your shit, and understand why exactly you outsourced something to a package.