Both of those have over >400 dependencies each [0] [1] but just in Rust instead - there hasn't been a Rust supply chain attack yet but is this any better? [2]

Admittedly you're not normally downloading the dependencies to your machine as you're often using pre-built binaries, but a malicious package could still run if a version was shipped with it.

[0]: https://github.com/biomejs/biome/blob/93182ea8e9d479fd0187ce...

[1]: https://github.com/oxc-project/oxc/blob/65bd5584bfce0c7da90f...

[2]: https://users.rust-lang.org/t/yet-another-npm-supply-chain-a...