I Peeked into My Node_Modules Directory and You Won’t Believe What Happened Next
medium.com
medium.com
I'm willing to bet a current car has an order of magnitude more - this is not your great-grandfather's Model T. Moreover, I am worried: only a handful of those parts are user-serviceable, not to mention those parts that are but a blackbox for proprietary firmware. The situation is quite similar here.
That said, the article would be better if it alluded to real examples. The fictional ones are funny & they did get me to investigate … but I can where some creators or maintainers would be pissed at the notion they did include some of the cruft reported. There should be some mention of this or a link to each scrutized project’s repo.
Still this post does illustrate the alarming nature of software dependency hell and how who-knows-what sort of code might easily be slipped into repositories these days.