Post #4048527

I've got an ongoing project at work to build some tooling to help quantify the complete supply chain risk of nodejs projects, and even in its prototype state (where not all commit-access-equivalent vectors are enumerated) the numbers that drop out of that thing are utterly horrifying.