It’s really kinda crazy how normalized it’s become to pull in hundreds of dependencies (aggregate of dependencies and subdendencies) from unvetted sources on the regular. Combined with the popular insistence of developers to run with all protections disabled (SIP, immutable system, non-admin user, etc) it makes for a whole lot of easy targets.