The large attack surface with npm is partly because of all the transitive dependencies used, which means that even if you only pull in a dozen packages directly

The large attack surface with npm is partly because of all the transitive dependencies used, which means that even if you only pull in a dozen packages directly, you're also using hundreds of other packages. Running `pip freeze` will list a lot of transitive dependencies as well, but I'm sure it'll be less than an equivalent JS project.