What is easier is to probably sneak in a new dependency that points to a malicious fork. Something like an XML to JSON library that does do the thing that is ad

What is easier is to probably sneak in a new dependency that points to a malicious fork. Something like an XML to JSON library that does do the thing that is advertised but also additional things.