Comment by throw-12-16

It gets even worse when you realize most extensions ship bundled node_modules and are a very juicy target for supply chain attacks.