[pier25]

You don't think depending on dozens or even hundreds of NPM packages with a single maintainer is an issue?

Just as an example, Express depends on 25 modules with a single maintainer.

https://npmgraph.js.org/?q=express

Obviously a router is a fraction of what's needed for any non trivial backend project.

[nailer]

It's an issue, but not a new issue and not an issue introduced by NPM or introduced by package managers.

People were cuddling and pasting code from random people on the Internet they didn't understand for many years before package managers where there were zero maintainers. Many people that don't properly understand supply chain issues still are.