You reviewed every line of that feature.
Two of you read it.
Then somebody typed install,
and four hundred packages
nobody has ever read
joined the same build,
with the same privileges,
in the same process.
That is the real proportion of the thing.
You audit the part you wrote,
which is perhaps two percent
of what actually runs.
Start with the part people skip.
Installing is not copying.
Packages can run code at install time,
on the machine doing the installing,
which these days is a build agent
holding your deploy credentials,
your registry token
and a checkout of everything you own.
The most valuable account in your company
is frequently the one
that runs untrusted scripts all day
as a matter of routine.
Then there is depth.
You chose eleven dependencies.
They chose the rest.
Somewhere down there is a package
with one maintainer
who has been doing it unpaid since 2016
and has been offered help
by a friendly stranger
who commits nothing suspicious
for the first three months.
That is not a thriller plot.
It is the ordinary way
a small useful library changes hands.
And nothing about that transfer
reaches you as an event.
It arrives as a version number
in a routine bump,
approved on a Friday
by someone clearing the board.
None of this argues for writing everything yourself.
It argues for a few dull habits.
Know the number.
Actually look at how many packages
you install, not how many you chose.
Pin them, lock them,
and let upgrades be a deliberate act
that somebody looks at,
rather than a range
that quietly resolves to whatever shipped last night.
Turn off install scripts where you can,
and notice which packages complain.
Give your build the narrowest credentials
that will still let it work,
because the build is the soft part
of every hardened company.
And before you add a dependency
for a function you could write in an afternoon,
price the afternoon properly.
You are not weighing it against nothing.
You are weighing it against trusting
somebody else's judgement,
automatically, unreviewed,
for as long as the product lives.
– Serguey Asael Shinder
