Who checks dependencies other than the author of the library ? The only time I check them is when they break and that's not a good thing. I see this argument a

Who checks dependencies other than the author of the library ? The only time I check them is when they break and that's not a good thing. I see this argument as “it’s not my job” type of argument. Most of the time you just install and use. If I had infinite time, I’d do it because it’s fun but I don’t so I don’t. If there’s a trust chain and I know for sure certain libraries are reviewed I’d have a peace of mind. Alas, that’s not the case and we spend our days in back burner paranoia or blissful ignorance.