Every dependency can run code on every computer your project runs on. That means you have to trust its author to: 1. not be malicious 2. not write a vulnerabi

Every dependency can run code on every computer your project runs on. That means you have to trust its author to: 1. not be malicious 2. not write a vulnerability by accident 3. not get their computer infected, their email account hijacked, etc. 4. be wise in transferring ownership 5. not add a dependency with a license incompatible with your project All the above concerns apply recursively to the dependencies of the dependency.