I’m not sure if that’s really relevant. I’m building those sensitive systems with Javascript, and just trust Snyk to notify me if anything untowards happens.

It is literally impossible to audit all these libraries. But that’s the case for almost all languages with a package manager.