On the other hand, would hackers target something that small? It seems to me like the benefits and drawbacks of open source for security would kick in around the same scale.
* small NPM packages depended on by popular ones
* video game mods and tools
* open source end user utilities