Or: Use less dependencies

Or: Use less dependencies

It may or may not be the case that there's more poorly maintained code in one's dependency tree when using a few big dependencies rather than a host of small ones- it would be interesting to see a formal study on the topic- but that's a different thing from a supply chain attack. A supply chain attack is about a malicious actor trying to slip bugs or backdoors into code in the hopes someone will pick it up and use it, and that requires a kind of middle ground in terms of maintainership. If the code is completely unmaintained, there's no opportunity for an attacker to slip something in. If the code is actively maintained by a team, it will be hard for them to slip their attack code by the other maintainers. It's only when the code is maintained but there aren't a lot of other people looking at the patches that it becomes possible for an attacker to incorporate their backdoor. An attacker might try to slip something into a poorly maintained section of a big project, but they're a lot more likely to encounter some kind of code review than if they succeed in taking over a poorly maintained project.