Not to pick on anyone, but I recently installed a stock storybook setup. Out of curiosity I did a count of all the node_modules (top level + nested). There were >2000 packages installed.
Now I know that if I follow the rules of a textbook professional (one that takes security seriously), then I'm obliged to audit all 2000 packages. But between you and the rest of the gazing internet, I don't do this. That's my dirty little secret. I don't give a shit. Gluing orphaned half-assed npm packages together and pretending everything is okay is my job.
The ironic part is how many hours we are murdering worrying about TypeScript or unit tests or integration tests and trying very very very hard not to notice that landfill we have placed under our massive rug.
There are too many technologies and not enough time to master them. Every time I dive into a popular node package I become more and more worried for the human race. We get things fundamentally wrong and it lives like that. For decades. And people come along and just obliviously use it like that and don't question it. Take something simple, like JWT. Or nonces. Or what people believe and implement around random numbers and how random numbers work (or, often, don't work). Bad information becomes bad code that sits around for a lifetime.
Is that any different from all that stack overflow copypasta you find all over source code, where the paster clearly had no idea how that code worked? And I’m talking about people who are being paid to ship code.
shudder. It’s a wonder anything functions at all these days.