This is why you need a library for additions. At least CVEs can be tracked appropriately, rather than the developer rolling out their NIH solution.