Because in web development it is perfectly normal to use 2 frameworks and 1200 random libraries to do the simplest of things. One compromised library will compromise all applications that rely on it directly or indirectly, no matter how small.
I absolutely hate this aspect of web development and frankly I’m scared every time I type npm install
This mindset has been spreading for… probably decades. Nowadays, it is even encouraged by certain popular programming languages, by including toolchains that make it as easy as possible to pull in third-party dependencies while shipping standard libraries so minimal that a developer is strongly encouraged to rely on them.
This inevitably leads to a world where software supply chain attacks have massive reach and high chances of success. And threat actors take advantage of it, of course.
Because in web development it is perfectly normal to use 2 frameworks and 1200 random libraries to do the simplest of things. One compromised library will compromise all applications that rely on it directly or indirectly, no matter how small.
I absolutely hate this aspect of web development and frankly I’m scared every time I type npm install
And it’s not just web development.
This mindset has been spreading for… probably decades. Nowadays, it is even encouraged by certain popular programming languages, by including toolchains that make it as easy as possible to pull in third-party dependencies while shipping standard libraries so minimal that a developer is strongly encouraged to rely on them.
This inevitably leads to a world where software supply chain attacks have massive reach and high chances of success. And threat actors take advantage of it, of course.