Auditing is nearly impossible.
The complete lack of a standard stdlib means always relying on community packages.
Also, not a complaint directly against node directly, but for the ecosystem and developers. There is not a culture of compatibility, further fueled by the fact that multiple versions of the same dependency can be included in the same code base by different dependencies.
Coming from any other language were it is a goal to keep external dependencies down, nodejs is nightmare fuel.
After all, if I love Java but hate AbstractSingletonProxyFactoryBeans, I'm probably going to hate being a professional Java developer.
Some would see the left-pad incident not as an isolated oddity, but as representative of the entire NodeJS ecosystem - showing a weak standard library, a culture of pulling random, unaudited code from the internet, and rats-nest dependencies.