It gets even worse when you realize most extensions ship bundled node_modules and are a very juicy target for supply chain attacks.