Your reply is very uncharitable. Newer versions of .NET rely on next to zero non-Microsoft dependencies. The most notable exception to this used to be Newtonsof

Your reply is very uncharitable. Newer versions of .NET rely on next to zero non-Microsoft dependencies. The most notable exception to this used to be Newtonsoft.Json, which has since been replaced with Microsoft-owned System.Text.Json. You can easily implement very complex business applications with app stacks like ASP.NET or WPF while relying on exactly zero non-Microsoft dependencies. The GP never said Microsoft "gets a pass." They were pointing out that there are stacks like .NET where reliance on third-party unvetted libraries is greatly reduced if not eliminated outright. Additionally, nearly all businesses run Windows anyway, so using Visual Studio and Visual Studio Code are not the risks you make them out to be. Centralized Active Directory policies already help guard against rogue extensions and such, assuming IT even cares (they nearly never do in my experience). Yes, the surface area threat of .NET and NuGet is far, far lower than that of NPM for nearly all apps.