Before dependency managers, you downloaded a zip with php files from people you dont even know the names of. (And never update any of the external libraries) T

Before dependency managers, you downloaded a zip with php files from people you dont even know the names of. (And never update any of the external libraries) These managers dont replace the chain of trust, if you dont trust a dependecy and the developer behind dont install it. "And it's impractical to audit them all." I dont use NPM but for composer.json: https://github.com/fabpot/local-php-security-checker https://github.com/fabpot/local-php-security-checker I agree, composer is not perfect, but before it was worse.