IMO it's up to the company to have a posture about this stuff. If the team expects you to use dependencies at the level of left-pad without any further scrutin

IMO it's up to the company to have a posture about this stuff. If the team expects you to use dependencies at the level of left-pad without any further scrutiny, then that's their risk appetite. Of course you can argue for or against this as part of the normal course of things. In an average startup/mid-size (i.e. a place with no enforced controls) I really doubt the soft expectation would be for you as a random engineer to pre-empt something like the xz backdoor. Or be worried about something as well-used as k9s/emacs. Of course, some companies are special cases with different expectations and requirements, ymmv.