> who have checked if those packages do not have security issues? There are several companies that provide this service. Socket.dev being the one that we use

> who have checked if those packages do not have security issues? There are several companies that provide this service. Socket.dev being the one that we use in the company where I work. We also make use of GitHub Advanced Security and Dependency Bot. Supply chain security is a problem for any language where your developers rely on third party packages, but agreed that it's particularly challenging with the JS ecosystem.