>effectively pushing the responsibility back onto the clients of the library. well, yes. that's how this should work. if you want to use a library, it's up t

>effectively pushing the responsibility back onto the clients of the library. well, yes. that's how this should work. if you want to use a library, it's up to you to decide whether or not it is a good fit for your project, including whether it has security issues that you need to worry about. a tool like NPM audit can help you make this decision, but there is no scenario where it makes a library developer responsible for fixing a security issue in your own project (unless you're paying them for that service).