Comment by lxgr

That's not much help if you don't vet all third-party dependencies closely, ideally at the source level pre obfuscation/minification.