Comment by Akronymus

Also, your own library, at this point, is much less of an attack vector than some dependency from a package manager