This is my favorite lately. Sure, some insane people use these packages for backend services, but we are just building a big JS blob that's statically shipped t

This is my favorite lately. Sure, some insane people use these packages for backend services, but we are just building a big JS blob that's statically shipped to the browser; none of the "vulnerabilities" in them apply. But try getting this across to people who think they need to track security issues they don't understand (not fix them, of course).