A word to the wise. Don't read the reddit thread around this. A lovely little snippet:

> > it's up to you as a developer to vet your dependencies

> This is effectively impossible on an individual level, and it's something that absolutely needs to be a community-level effort.

Don't hire this person... Dependencies are absolutely, FULL STOP, your responsibility. YOU are the one making the money NOT the maintainer.