> For dependencies, simply pin your versions and put library upgrades through a code review, that way no unknown code enters your system.

These are all solid recommendations but don't excuse shit behavior on behalf of certain poor participants in the ecosystem. Which it seems you're super eager to do for some reason.

> Right, no one wants to do the work.

I mean so far it looks like one guy lol.

> For what? Buyers remorse. You blindly pulled code without looking at it, then regretted pulling it. Sorry.

We're talking about this guy's motivations not that of the consumers.