Comment by joss82

In practice though, even the smallest toy project will pull out hundred tiny dependencies.

This is why funny stories like leftpadgate can happen.

Relying on an external dependency is a net win if and only if the time gain overcomes the loss of control.

Maybe regrouping all these tiny libraries under an umbrella project (lets call it node-utils or js-tinytools or whatever) will mitigate the problem?

This project will not have any external dependency though will be used by most of the projects and ergo might be watched with much more attention.