This year alone, thousands of JavaScript vulnerabilities were reported, yet many developers still underestimate the security risks of dependencies in front-end apps. These scripts run automatically when you install a dependency (or a sub-dependency) and can do anything on your machine-- just like if you were to run unverified software from the internet. Some risks can be mitigated, such as through a Content Security Policy (CSP) and disabling install scripts, other mitigations, such as analyzing maintainers and package code, would require such a tremendous amount of effort that they are usually not feasible.