From a security perspective, sanitizing all the packages that
create-react-app installs seems to be a massive undertaking.
I just did a quick count of installed packages, by entering
npm ls into the command line of my installation home, and counted 2226 packages! :O Furthermore, that was just local packages, and does not include global.
How is this massive package tree properly sanitized?
I suppose there is a greater question here, of how to scan npm-installed packages, and their dependencies.
Does it make sense to run each and every one of these packages through a scanner?