The problem is really not the size or the number of files (both a pretty manageable by modern hardware), but that you execute mostly unverified code by several

The problem is really not the size or the number of files (both a pretty manageable by modern hardware), but that you execute mostly unverified code by several thousand people. It only takes one of those to go rogue to have your data siphoned, your drive encrypted ... you name it. Sure, big projects (hopefully!) watch their dependencies, but you auditing 13k packages is simply impossible. And, given how much these numbers explode, it unfortunately seems like people simply add a dependency without doing their due diligence.