Of course, it's a risk with any dependency, but for a small number of dependencies you're more likely to be able to do some level of vetting. The university of

Of course, it's a risk with any dependency, but for a small number of dependencies you're more likely to be able to do some level of vetting. The university of Minnesota would have had a much easier time not getting caught if there had been a tree of thousands of independently maintained dependencies