If you're trying to audit React, don't you either need to audit its build artifacts rather than its source, or audit those dev dependencies too?