Are npm packages really safe to use?

If you're going to utilize third-party code, you should at least skim through it. Just because something is open source doesn’t mean it’s fully safe; you've got to make sure to actually read the code and know what you're adding to your project.

Every code can have vulnerabilities, regardless of the platform or language. In my experience, the issues flagged by npm audit aren't typically because the package is outright malicious, but rather certain bugs that arise when using the package in specific ways. For example, if you input raw user data into a function without proper safety, it might lead to vulnerabilities. So, being a careful developer is crucial when handling user data and ensuring the packages you choose are reputable.

Absolutely, the same goes for any frontend libraries too. It's wise to use tools like Dependabot to alert you when libraries have updates. Try not to upgrade right away unless there's a pressing security notice. Stick with popular and well-maintained libraries since they're usually audited and backed by multiple contributors. Or, if possible, write the functionality yourself for smaller tasks. Just be aware of 'typo-confusion attacks'; someone might create a malicious package with a name close to a real one, so always double-check what you’re installing! This type of risk is known as a supply chain attack.