Npm being split means more metadata, not necessarily more code. You admit to not reading your code or inspecting your dep, and you assert that you have no problems - based on what?
Your deps.txt is barely different than a lock file here.
Reading the code from dependencies is not really hard anywhere here.
Re:Malicious crossenv package on npm
by thehardsphere on Thursday August 03, 2017 @10:00AM
(#14919606)
> you assert that you have no problems - based on what?
The software works as intended and I know that my dependencies have not changed without me explictly changing them.
> Your deps.txt is barely different than a lock file here.
That command produces a tree of all dependencies and their dependencies. I don't know what that has to do with a lock file.
You know how hard it would be for me to vet the dependency if I did have a dependency problem? "mvn dependency:tree > deps.txt." It would take half the day, but I could vet them all.
I also have a Django project on the side. It has 8 dependencies. I have vetted all of them very carefully. It's smaller than the work project, but that's not the reason why it has fewer dependencies than a typical JS mess. It has fewer dependencies, because Pythonistas have a philosophy and cultural practices that produces quality software with lots of functionality included.