> But it only takes a few packages like these to explode the size of the dependency tree.

and create another future opportunity for a supply chain attack