[isabellat]

This post does a really great job explaining the risk we all take when downloading code that we haven't audited from the internet. I've never taken the time to audit the code I'm including in my projects. Instead, I blindly trust that someone else has. I love how socket has identified common security red flags and is automatically warning users about what they find. Great to see!

[cube00]

For a lone dev, it's impossible but I wonder if the big players like Facebook and Google actually audit all the transitive dependencies they've selected each time they release a new version of React or Angular.