Run npm audit or equivalent before launch. Known vulnerabilities in packages you didn't write are still your problem — transitive dependencies included.