I think when a project heavily depends on dependencies it is easy for security issues to make it too risky. Lately, I've been seeing more and more npm packages

I think when a project heavily depends on dependencies it is easy for security issues to make it too risky. Lately, I've been seeing more and more npm packages that keep "extending" a dependency to add more features, which eventually gets abandoned. I'll use this package, multer-s3-transform, as an example. Its been abandoned. It depends on multer-s3, which depends on AWS-SDK and multer, which then depends on busboy. Now, AWS-SDK, Multer, and Busboy have organizations maintaining them. However, the random projects overlayed on top of those are by single individuals. The answer is to two-fold. Avoid overlayed projects and avoid big projects managed by a single individual.