Some node.js libraries (just as an example) can pull in literally hundreds of dependencies. Some of these dependencies are small packages that only have one contributor. Often times the contributor doesn't even have any personal information listed other than their username.
How is it possible to trust that nobody in those hundreds of libraries will never act maliciously, get their account hacked, have a change of heart, purposefully introduce a vulnerability, etc?
It seems that all it would take is one point in the chain to get compromised, or have never had good intentions from the beginning, and that could lead to huge security problems or data breaches. A compromised plugin in a build system could steal source code.
It just seems like the wild west and a disaster waiting to happen. Do companies really review the source code of every single package they use, and the changes on every single update? That just sounds unmaintainable.
I could understand trusting a paid library published by a business, but I don't understand projects using these deeply nested dependencies published by internet strangers.
I guess what my question is that I am having trust issues and don't know how to properly include a library without worrying that I could accidentally compromise a customer's business.