Dependencies

This monorepo inlines 3rd party code once it has survived human and AI auditing, and keeps its dependencies as few as possible. While at it, we may also remove features and options we don’t need, or rewrite it to improve performance.

The original authors will be credited where credit is due, and their licenses are appended to the LICENSE of the package that ships their code.

Why

Before we go into our reasoning, we would like to point out that this is not criticism towards any credited library author in particular, these are rather general observations.

Supply chain attacks

Unfortunately in the npm ecosystem, security vulnerabilities and supply chain attacks are becoming more commonplace. We also keep finding security vulnerabilities in code out there, all of which we were able to manually verify and confirm. We report them through private channels, but it makes it harder to trust code we haven’t read ourselves.

In 2025 alone, Sonatype counted more than 454,600 new malicious packages, over 1.2 million since they started counting.

npm has since required 2FA and short-lived tokens for publishing, and scans every release for malware before it can be installed. Both help, but neither replaces reading the code: ChainDrop was published through the maintainers’ own CI a week after scanning launched, and in September a Shai-Hulud payload passed the scanner with the same hash as one documented in May.

The original “vibe coding”, which is installing 3rd party dependencies and not reading the code is no longer something we feel comfortable doing, and maybe something we should have never done in the first place.

Update frequency

While we could make an effort to audit 3rd party code once, it is not enough - every time a new version gets shipped, we have to audit the changes.

We are seeing a surge in terms of update frequency and code churn, in some cases dozens to hundreds of commits per day, which we can not possibly verify in our spare time.

GitHub counted about 1 billion commits in all of 2025, by April 2026 it was at 275 million a week. Across 623 million changes from 2023 to 2026, GitClear found 15% more code rewritten within two weeks of being written. An ongoing study from Harvard of 700+ companies sees coding agents bring 30% more code, 20% more commits and 23% more pull requests.

This monorepo would not exist without the projects we credit. For the time being, we feel safer making the code we depend on our own: it goes through adversarial reviews, we fix whatever we find, and nobody else can publish a new version of it. This may well change again.

This is not advice for anyone else, just what we decided to do for ourselves.