Developer Warns That Every Dependency Is a Supply Chain Attack Waiting to Happen

Software developer Ben Hoyt warns that third-party libraries—including dev dependencies—pose serious supply chain risks, citing the XZ backdoor, Trivy, and LiteLLM incidents. He argues that automatic updates via tools like Dependabot often introduce more vulnerabilities than they fix, as updated code rarely receives the same scrutiny as initial additions. He advises minimizing dependencies, disabling automated updaters, and carefully evaluating every library before adding it to a project.