It's less about the number of "dependencies" and more about the raw amount of code you need to audit. If you are capable of auditing 1 100k loc package, why ar

It's less about the number of "dependencies" and more about the raw amount of code you need to audit. If you are capable of auditing 1 100k loc package, why aren't you capable of auditing 100 1k loc packages? Once you have audited a specific version, you can either vendor your dependencies (which I always encourage), or at the very least can lock all transitive deps down which both npm and yarn do by default now. If you vendor your deps, upgrades/changes are as easy to audit as a single project as you can get a diff of what changed right there in your own system. Now I'll agree that auditing any large amount of code is extremely difficult, but it's not a problem you can solve by switching to another ecosystem, at best you'll just move most of the code outside the realm you decided you need to audit.