Comment by Jalad

Supply-chain attacks aren't really a property of the dependency management system

Not having a dependency management system isn't a solution to supply chain attacks, auditing your dependencies is