> dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base

This mindset is changing, in the npm ecosystem, managing and updating dependencies have become somewhat of a gamble. It is no longer if, its when you are compromised.