That assumes a lot. My code may utilize one dependency that itself utilizes a few dozen useless ones. Whereas someone else may carefully choose 20 dependenci

That assumes a lot. My code may utilize one dependency that itself utilizes a few dozen useless ones. Whereas someone else may carefully choose 20 dependencies, none of which include any dependencies. The issue is measuring the trustworthiness of a dependency, and recursively doing that operation throughout the dependency graph. Simply focusing on the number of dependencies or the size of a dependency is silly.