IMO "how many packages are the dependencies broken into" is a far less useful question than "how many maintainers have commit access to the dependency subtree".

IMO "how many packages are the dependencies broken into" is a far less useful question than "how many maintainers have commit access to the dependency subtree". The latter is a better question because: * It's directly connected to your security posture. * It's a stable metric across languages with different norms about module size.