Because in web development it is perfectly normal to use 2 frameworks and 1200 random libraries to do the simplest of things. One compromised library will compromise all applications that rely on it directly or indirectly, no matter how small.
I absolutely hate this aspect of web development and frankly I’m scared every time I type npm install
This mindset has been spreading for… probably decades. Nowadays, it is even pushed by certain popular programming languages, by including a toolchain that makes it as easy as possible to pull in third-party dependencies while offering a standard library so minimal that a developer is strongly encouraged to rely on said dependencies.
This inevitably leads to a world where software supply chain attacks have massive reach and high chances of success. And threat actors take advantage of it, of course.
Because in web development it is perfectly normal to use 2 frameworks and 1200 random libraries to do the simplest of things. One compromised library will compromise all applications that rely on it directly or indirectly, no matter how small.
I absolutely hate this aspect of web development and frankly I’m scared every time I type npm install
And it’s not just web development.
This mindset has been spreading for… probably decades. Nowadays, it is even pushed by certain popular programming languages, by including a toolchain that makes it as easy as possible to pull in third-party dependencies while offering a standard library so minimal that a developer is strongly encouraged to rely on said dependencies.
This inevitably leads to a world where software supply chain attacks have massive reach and high chances of success. And threat actors take advantage of it, of course.