If you want to be concerned about the npm chain of dependencies model, one thing you should probably think about is that there is no curation of code on npm, so

If you want to be concerned about the npm chain of dependencies model, one thing you should probably think about is that there is no curation of code on npm, so a package could be malicious (e.g. if an attacker compromised a set of package maintainer creds from a dot file) and npm packages (like most package formats) have the ability to execute code on install...