A small web project easily installs hundreds of packages through its dependencies, and each one runs with the same power as your own code. Software supply chain failures are number 3 in the OWASP Top 10 for 2025.