> It's a nodejs app, and there is no reason to have a problem with that.

Node apps typically have serious software supply chain problems. Their dependency trees are typically unauditable in practice.