Who is worrying? If JavaScript is on the front end the supply chain attacks are really not your problem.