yep. In theory a dotnet project pulling in nuget packages is in the same class as a node project pulling in NPM packages. In practice, it's tremendously differ

yep. In theory a dotnet project pulling in nuget packages is in the same class as a node project pulling in NPM packages. In practice, it's tremendously different. As mentioned, a do-nothing react app has 1500 dependencies, all managed by who-knows-how-many different companies and individuals A do-nothing aspnetcore app has maybe a few dozen dependencies, and with the exception of Newtonsoft.JSON, all of these are managed and supported by Microsoft. When you scale that up to a real app, I don't even know what you get with Node/npm? 2500 dependencies? With aspnetcore you probably end up adding 10-20 more dependencies, and some of them are probably written by Microsoft. So, your "potentially untrustworthy package count" in node is about 2000 packages, whereas for aspnet it's about 10 packages. You can review and pay attention to 10 packages. 2000? Not so much Aside: A java/maven project probably falls somewhere in between, but closer to the aspnet scenario. Instead of a few dozen dependencies you might have 50, but it's still realistically possible to review them all, and they're far more likely to come from trusted publishers such as the Apache foundation.