Yes, I know but that meme refers to things like openssl. I’m referring to devs who decide to depend on no name, not even beta tested packages that some college kid wrote to pad their resume. The college kid did nothing wrong, the professional who decided to use a package like that is the person who shouldn’t be working in dev.