Just found the similar article that continues the problem of dependencies security. May be interesting.
https://medium.com/@caffeinum/maintaining-security-while-juggling-burning-dependencies-a401759c840e