Twelve packages with twelve dependencies each is 144. I’ve seen >10x this level of blow up on multiple products at multiple companies.
One company missed installing malware behind all the firewalls of most of the fortune 500 by less than a week.
We made a procedural change to the build process of a product that had been shipping for years.
The change hit our CI/CD 5 days before one of the big language package managers started spewing malware at us.
Package maintainer count bloat is a serious real world problem.
Ignoring it is negligent.