I should know, I check those companies for a living. This is one of the most often flagged issues: unaudited Node.js dependencies. "Oh but we don't have the manpower to do that, think about how much code that is".
In my experience, most devs and companies don't consider the dependencies they load 'their' code.
They only look at the code they write, not everything they deploy.
