That's a different, but related concern. Yes deep dependency graphs have a big trust problem, but at the very least in that case you can use CSP and SRI to veri

That's a different, but related concern. Yes deep dependency graphs have a big trust problem, but at the very least in that case you can use CSP and SRI to verify the integrity after the asset has been built. A compromised node module also has the mitagting fator that it slowly propagates as people update which doesn't make the attack as immediate and it gives people an opportunity to review the code as they update. For remote third party JS that's included on many websites you have an immediate and direct remote code exec vector. For something central like Google Analytics this would be devestating.