Risk of what? You can make dependencies fully sticky with lockfiles.

Instead of adding a file to your “libs” folder you add a line to package.json

Any code that isn’t in my repo is code I don’t have to maintain.

Left pad can’t happen anymore (for 4 years now) and if you don’t know that you’re either lying or outdated (like those files in your libs folder)