any developer who took on a dependency and didn't fully audit the code and all of its dependencies should be instantly fired, and then thrown to the wolves.