I think the issue is each module tends to include far more code than just what the project needed. If everything was like the NPM meme where you install a pack

I think the issue is each module tends to include far more code than just what the project needed. If everything was like the NPM meme where you install a package to check if something is true, then your LOC for that module with be quite limited. However a single dependency is often big itself, and the 50 dependencies it has are also quite big. The LOC in the dep-dep is not the same as if it was written by hand in the dep. So if you wrote your dep by hand you may use, say, 500,000 LOC - but with the tree of dependencies not being a 1:1 to what you use, you have to audit more like 2Mil LOC. Perhaps an audit could be aided by some sort of tree-shaking scenario, where all non-used code is removed, leaving you with the real 500,000 LOC that needs review.. Would be interesting. I've been having this same problem with Rust lately. Frankly, I think it's true for any package platform you use.