Wouter de Jong on Nostr: I'm afraid the only way to help these packages is by having contributors that do not ...

I'm afraid the only way to help these packages is by having contributors that do not do this because they want it, but because they are paid to do it.

However, even if companies know their full supply chain, they can't possibly help maintaining all their dependencies up to this deep. It's a very hard problem to tackle...