To what extent should one trust web/js frameworks?
Most frameworks are open source - developed in the open. Hence, many people can semi anonymously commit to the project. Human validation might be tricked and an attacker is able to commit some "harmful" code that then gets unintentionally called by the web programmer, who uses only the most abstract API layer.
How realistic is such a scenario? And how harmful could such code be?
Furthermore, Angular and React were initiated by Google and Facebook and have a strict revision process. I am now looking at framework developed by Alibaba and (for the most part) the Chinese open source community.
Considering the somewhat bad reputation of Chinese IT products, is there more reason to be concerned? or is this just something that the media/politicians push?