Yeah I agree except I don’t understand what the point of the tweet was. Whether you have 1000 deps or 10 deps, the problem is about security, not dep count. Who’s going to carefully audit 10 deps when they’re transitive? More than would audit 1000, but not many more. Having few deps does not appear to be the solution to dependency security.