I think the issue is each module tends to include far more code than just what the project needed.

If everything was like the NPM meme where you install a package to check if something is true, then your LOC for that module with be quite limited.

However a single dependency is often big itself, and the 50 dependencies it has are also quite big. The LOC in the dep-dep is not the same as if it was written by hand in the dep.

So if you wrote your dep by hand you may use, say, 500,000 LOC - but with the tree of dependencies not being a 1:1 to what you use, you have to audit more like 2Mil LOC. Perhaps an audit could be aided by some sort of tree-shaking scenario, where all non-used code is removed, leaving you with the real 500,000 LOC that needs review.. Would be interesting.

I've been having this same problem with Rust lately. Frankly, I think it's true for any package platform you use.