A deep dive on core-js, its maintainer, and the JavaScript secure software supply-chain fiasco that has gotten out of control.