It is very hard to control your dependencies when you use a framework or a transpiler in JS. They bring in tons of other packages which have their own dependencies and so on.

This has also opened a new dangerous attack vector where hackers take over a small forgotten component used by many nodejs packages and inject malicious code into projects without anyone noticing.