I understand, you make a choice that summarizes the data the best that you can; I wasn't trying to attack you. I was trying to point out that choice of a language for the representation of your configuration is exactly that, a choice.

I don't know that I agree that having the dependency definition in native code is a source of vulnerabilities; it could make the definition easier to write for people packaging code in that language. Also, I think JSON could be considered native code for npm since it is written in nodejs/javascript.