The javascript world has a culture of lots of small dependencies that end up becoming a huge tree no one could reasonable vendor or audit changes for. Worse the

The javascript world has a culture of lots of small dependencies that end up becoming a huge tree no one could reasonable vendor or audit changes for. Worse these small dependencies churn much faster than for other languages. With that culture supply chain attacks and this kind of vulnerability will keep happening a lot. You want few dependencies, you want them to be widely used and you want them to be stable. Pulling in a tree of modules to check if something is odd or even isn't a good idea.