that nice, tiny, single-file dependency that replaces a huge, well-known library? it's someone's weekend project. it's not well-tested. it has a buffer overflow vulnerability in it. it didn't need to be attacked, it was faulty to begin with. you didn't actually understand it.

i don't have the answers, sorry.