The world's most critical software infrastructure is maintained by volunteers who have no security teams, no SLAs, and often no security training. Feross Aboukhadijeh recounted a prolific npm maintainer running a 6-letter password with full conviction that it was fine. Companies relying on this code need to own the vetting responsibility — and fund the people doing the work.