I work in SCA/SBOM. >What is more likely to be vulnerable, At the end of the day you are at much higher risks of one of those 10 packages getting owned by som

I work in SCA/SBOM. >What is more likely to be vulnerable, At the end of the day you are at much higher risks of one of those 10 packages getting owned by some external party and suddenly the next version is pulling a bitcoin miner, or something that steals everything it can from your CI/CD, or does a take over on your customers. And it's never 10 (well at least for JS), it's hundreds, or if you're team is insane, thousands.