This happened once with open sores now this behavior has turned up to 11. People taking dependencies they don't even know what, full of incorrect code, vulns intentionally or not, delegate everything take no responsibility.