Adding a package as a dependency outsources the work of developing that code—designing, writing, testing, debugging, and maintaining—to someone else on the internet, someone you often don’t know. . . . . . . . We are trusting more code with less justification for doing so.
