My main concern is the impossibility of finding trust in library dependencies. A typical React app has somewhere over 2,000 packages from almost as many differ

My main concern is the impossibility of finding trust in library dependencies. A typical React app has somewhere over 2,000 packages from almost as many different sources. It is impossible to check the reputability of each contributor. I'm aware of things like "npm audit", but with the amount of false positives that spews out, it seems one just has to trust the entire ecosystem. My intuition keeps telling me that this is a disaster waiting to happen, and I'm trying to understand how this can be so pervasive.